quart-security 1.4.0__tar.gz → 2.0.0__tar.gz

{quart_security-1.4.0 → quart_security-2.0.0}/PKG-INFO

@@ -1,19 +1,21 @@
 Metadata-Version: 2.4
 Name: quart-security
-Version: 1.4.0
+Version: 2.0.0
 Summary: Native async auth for Quart
 Author: quart-security maintainers
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: quart>=0.20.0
-Requires-Dist: sqlalchemy>=2.0
-Requires-Dist: libpass>=1.9
+Requires-Dist: sqlalchemy[asyncio]>=2.0
+Requires-Dist: libpass[bcrypt]>=1.9.3
 Requires-Dist: pyotp>=2.9
-Requires-Dist: qrcode>=8.0
+Requires-Dist: qrcode[pil]>=8.0
 Requires-Dist: webauthn>=2.7
+Requires-Dist: cryptography>=50.0.0
+Requires-Dist: cbor2>=5.9.0
 Requires-Dist: wtforms>=3.1
-Requires-Dist: aiosmtplib>=3.0
+Requires-Dist: aiosmtplib>=5.1.2
 Requires-Dist: blinker>=1.7
 Requires-Dist: email-validator>=2.0
 Requires-Dist: argon2-cffi>=23.1
@@ -89,7 +91,9 @@ Package build backend: `flit`.
 from quart import Quart
 from quart_security import Security, SQLAlchemyUserDatastore
 
-# your models should include fields used by auth, roles, and MFA/WebAuthn
+import os
+
+# Models must include the fields required by enabled features.
 from myapp.models import db, User, Role, WebAuthnCredential
 
 
@@ -97,8 +101,7 @@ def create_app():
     app = Quart(__name__)
 
     app.config.update(
-        SECRET_KEY="change-me",
-        SECURITY_PASSWORD_SALT="change-me-too",
+        SECRET_KEY=os.environ["SECRET_KEY"],
         SECURITY_POST_LOGIN_VIEW="/dashboard",
         SECURITY_POST_REGISTER_VIEW="/login",
     )
@@ -132,17 +135,25 @@ For tracking / MFA / WebAuthn features:
 - `fs_webauthn_user_handle`
 - relationship/association for stored WebAuthn credentials
 
-Optional for lockout support:
+Required for the default lockout policy:
 - `failed_login_count`
 - `locked_until`
 
+These fields are required when login or MFA lockout is enabled. The built-in
+counter limits account-level guesses. Deploy an application or edge rate limiter
+for source IP and distributed abuse controls.
+
+The database must enforce unique normalized emails, `fs_uniquifier` values,
+WebAuthn user handles, and credential IDs. Use a stable primary key separate from
+`fs_uniquifier`: this value changes when security settings change.
+
 ## Key Configuration
 
 The extension uses `SECURITY_*` keys for migration-friendly configuration.
 
 Core:
 - `SECURITY_PASSWORD_HASH` (default: `argon2` / argon2id; set to `pbkdf2_sha512` to keep old behavior)
-- `SECURITY_PASSWORD_SALT` (recommended)
+- `SECURITY_PASSWORD_SALT` (legacy salted-hash verification only)
 - `SECURITY_PASSWORD_LENGTH_MIN` (default: `12`)
 - `SECURITY_PASSWORD_BREACH_CHECK` (default: `True`) - HIBP k-anonymity check on register/change
 - `SECURITY_PASSWORD_BREACH_COUNT_MIN` (default: `1`) - minimum breach count to reject
@@ -153,6 +164,8 @@ Core:
 - `SECURITY_CHANGEABLE`
 - `SECURITY_TRACKABLE`
 - `SECURITY_CSRF_PROTECT` (default: `True`)
+- `SECURITY_COOKIE_SECURE` (default: `True`; sets `SESSION_COOKIE_SECURE`)
+- `SECURITY_FRESHNESS` (default: `60` minutes)
 
 Existing pbkdf2_sha512 and bcrypt hashes continue to verify after the argon2 default change. They are transparently rehashed to argon2id on the user's next successful login.
 
@@ -162,6 +175,14 @@ Existing pbkdf2_sha512 and bcrypt hashes continue to verify after the argon2 def
 - `SECURITY_MULTI_FACTOR_RECOVERY_CODES`
 - `SECURITY_MULTI_FACTOR_RECOVERY_CODES_N`
 
+Recovery codes are displayed only when generated and are stored as keyed hashes.
+Existing plaintext codes remain valid until their next successful use, when the
+remaining codes are migrated.
+
+Accepted TOTP time steps, recovery codes, and WebAuthn challenges cannot be reused.
+Disabling an authenticator requires a current TOTP or unused recovery code.
+Wait for the next TOTP code if the current one was just used to sign in.
+
 WebAuthn:
 - `SECURITY_WEBAUTHN`
 - `SECURITY_WAN_ALLOW_AS_FIRST_FACTOR`
@@ -180,7 +201,7 @@ Routing:
 Core:
 - `/login`
 - `/register`
-- `/logout`
+- `/logout` (POST only)
 - `/change`
 
 2FA:
@@ -259,3 +280,81 @@ Run this in a HTTPS staging environment with production-like hostnames and real
 - Set explicit WebAuthn RP values (`SECURITY_WAN_RP_ID`, `SECURITY_WAN_EXPECTED_ORIGIN`) when behind proxies or multiple domains.
 - Keep CSRF protection enabled unless you have a deliberate replacement.
 
+## Version 2.0.0 migration
+
+This update requires a shared `quart_security_state` table. It stores expiring
+authentication records and verification state. Cookie contents contain opaque
+references, not pending authenticator secrets. All workers must use the same
+database. Existing login cookies are rejected after this update.
+
+Create the table through your application's database migration before deploying
+the new library. For example, in an Alembic migration:
+
+```python
+from alembic import op
+from quart_security import SecurityState
+
+
+def upgrade():
+    SecurityState.__table__.create(op.get_bind())
+```
+
+This includes the expiry index. Startup checks that the table is present. Protect
+database access and backups because pending TOTP secrets are stored there.
+Expired records are removed when new state is written. Maintenance jobs can also
+call `await security.state_store.purge_expired()` in an application context and
+close the datastore after the job.
+
+For a session factory, use `async_sessionmaker(engine, expire_on_commit=False)`.
+The library retains the session through commits and closes factory-owned sessions
+at the end of each HTTP request or WebSocket connection. Read-only and failed
+requests also close their sessions. A supplied `db.session` or session instance
+remains owned by the host application; the host must close or roll it back.
+Outside a request, close factory-owned sessions with `await datastore.close()`.
+Do not share one session across concurrent tasks.
+
+Password and MFA profile changes rotate the user's `fs_uniquifier`, which rejects
+older authenticated and pending login sessions. Logout revokes the current
+authentication record, including copied cookies for that session. Password
+changes keep the requesting session authenticated. Passkey registration and
+deletion also revoke older sessions. A `secondary` passkey cannot perform
+passwordless sign-in. A primary passkey uses its own user verification and does
+not require the account's TOTP code.
+
+Password helpers now use the current application's settings. Outside an app
+context, pass `app=app`, for example `hash_password(password, app=app)`.
+
+Cookies default to Secure, HttpOnly, and SameSite=Lax. For local HTTP development
+only, set `SECURITY_COOKIE_SECURE=False`. An explicit SameSite value is preserved.
+Use a strong random secret key and explicit RP/origin settings behind proxies.
+The host still needs source-IP and global rate limits; account lockout does not
+limit registration or anonymous challenge generation. Lockout fields are required
+when `SECURITY_LOGIN_MAX_ATTEMPTS` is greater than zero. Setting it to zero
+explicitly disables account lockout.
+
+Custom datastores require a shared `state_store` passed to `Security`. Its async
+methods must implement this contract and propagate storage errors:
+
+| Method | Contract |
+| --- | --- |
+| `put(payload, ttl=seconds, token=None)` | Persist a dictionary with an expiry and return an unpredictable reference. |
+| `get(token)` | Return unexpired state or None. |
+| `pop(token)` | Atomically consume unexpired state; exactly one caller receives it. |
+| `claim(token, ttl=seconds)` | Atomically reserve a key; return False while another unexpired claim exists. |
+
+A process-local dictionary is suitable only for tests. Custom datastores must also
+provide `record_auth_failure(user, max_attempts=..., lockout_minutes=...)` as an
+atomic increment/lock update and
+`replace_recovery_codes(user, expected, remaining)` as an atomic conditional
+replacement returning a boolean. `rotate_uniquifier(user, expected, replacement)`
+must atomically check the old value and persist both the new value and staged
+profile changes. Return False and roll back staged changes when the old value no
+longer matches. Concurrent profile updates return HTTP 409; the user must sign in
+again. Persist these changes before returning. The
+extension fails at initialization if an enabled control lacks its required hook
+or SQLAlchemy model fields.
+
+Dependencies now include the Pillow, bcrypt, and SQLAlchemy asyncio extras and patched
+minimum versions of aiosmtplib, cryptography, and cbor2. The release workflow runs
+lint and tests before building and publishing. CI tests Python 3.11 through 3.14.
+

{quart_security-1.4.0 → quart_security-2.0.0}/README.md

@@ -61,7 +61,9 @@ Package build backend: `flit`.
 from quart import Quart
 from quart_security import Security, SQLAlchemyUserDatastore
 
-# your models should include fields used by auth, roles, and MFA/WebAuthn
+import os
+
+# Models must include the fields required by enabled features.
 from myapp.models import db, User, Role, WebAuthnCredential
 
 
@@ -69,8 +71,7 @@ def create_app():
     app = Quart(__name__)
 
     app.config.update(
-        SECRET_KEY="change-me",
-        SECURITY_PASSWORD_SALT="change-me-too",
+        SECRET_KEY=os.environ["SECRET_KEY"],
         SECURITY_POST_LOGIN_VIEW="/dashboard",
         SECURITY_POST_REGISTER_VIEW="/login",
     )
@@ -104,17 +105,25 @@ For tracking / MFA / WebAuthn features:
 - `fs_webauthn_user_handle`
 - relationship/association for stored WebAuthn credentials
 
-Optional for lockout support:
+Required for the default lockout policy:
 - `failed_login_count`
 - `locked_until`
 
+These fields are required when login or MFA lockout is enabled. The built-in
+counter limits account-level guesses. Deploy an application or edge rate limiter
+for source IP and distributed abuse controls.
+
+The database must enforce unique normalized emails, `fs_uniquifier` values,
+WebAuthn user handles, and credential IDs. Use a stable primary key separate from
+`fs_uniquifier`: this value changes when security settings change.
+
 ## Key Configuration
 
 The extension uses `SECURITY_*` keys for migration-friendly configuration.
 
 Core:
 - `SECURITY_PASSWORD_HASH` (default: `argon2` / argon2id; set to `pbkdf2_sha512` to keep old behavior)
-- `SECURITY_PASSWORD_SALT` (recommended)
+- `SECURITY_PASSWORD_SALT` (legacy salted-hash verification only)
 - `SECURITY_PASSWORD_LENGTH_MIN` (default: `12`)
 - `SECURITY_PASSWORD_BREACH_CHECK` (default: `True`) - HIBP k-anonymity check on register/change
 - `SECURITY_PASSWORD_BREACH_COUNT_MIN` (default: `1`) - minimum breach count to reject
@@ -125,6 +134,8 @@ Core:
 - `SECURITY_CHANGEABLE`
 - `SECURITY_TRACKABLE`
 - `SECURITY_CSRF_PROTECT` (default: `True`)
+- `SECURITY_COOKIE_SECURE` (default: `True`; sets `SESSION_COOKIE_SECURE`)
+- `SECURITY_FRESHNESS` (default: `60` minutes)
 
 Existing pbkdf2_sha512 and bcrypt hashes continue to verify after the argon2 default change. They are transparently rehashed to argon2id on the user's next successful login.
 
@@ -134,6 +145,14 @@ Existing pbkdf2_sha512 and bcrypt hashes continue to verify after the argon2 def
 - `SECURITY_MULTI_FACTOR_RECOVERY_CODES`
 - `SECURITY_MULTI_FACTOR_RECOVERY_CODES_N`
 
+Recovery codes are displayed only when generated and are stored as keyed hashes.
+Existing plaintext codes remain valid until their next successful use, when the
+remaining codes are migrated.
+
+Accepted TOTP time steps, recovery codes, and WebAuthn challenges cannot be reused.
+Disabling an authenticator requires a current TOTP or unused recovery code.
+Wait for the next TOTP code if the current one was just used to sign in.
+
 WebAuthn:
 - `SECURITY_WEBAUTHN`
 - `SECURITY_WAN_ALLOW_AS_FIRST_FACTOR`
@@ -152,7 +171,7 @@ Routing:
 Core:
 - `/login`
 - `/register`
-- `/logout`
+- `/logout` (POST only)
 - `/change`
 
 2FA:
@@ -230,3 +249,81 @@ Run this in a HTTPS staging environment with production-like hostnames and real
 - Run behind HTTPS for WebAuthn in non-local environments.
 - Set explicit WebAuthn RP values (`SECURITY_WAN_RP_ID`, `SECURITY_WAN_EXPECTED_ORIGIN`) when behind proxies or multiple domains.
 - Keep CSRF protection enabled unless you have a deliberate replacement.
+
+## Version 2.0.0 migration
+
+This update requires a shared `quart_security_state` table. It stores expiring
+authentication records and verification state. Cookie contents contain opaque
+references, not pending authenticator secrets. All workers must use the same
+database. Existing login cookies are rejected after this update.
+
+Create the table through your application's database migration before deploying
+the new library. For example, in an Alembic migration:
+
+```python
+from alembic import op
+from quart_security import SecurityState
+
+
+def upgrade():
+    SecurityState.__table__.create(op.get_bind())
+```
+
+This includes the expiry index. Startup checks that the table is present. Protect
+database access and backups because pending TOTP secrets are stored there.
+Expired records are removed when new state is written. Maintenance jobs can also
+call `await security.state_store.purge_expired()` in an application context and
+close the datastore after the job.
+
+For a session factory, use `async_sessionmaker(engine, expire_on_commit=False)`.
+The library retains the session through commits and closes factory-owned sessions
+at the end of each HTTP request or WebSocket connection. Read-only and failed
+requests also close their sessions. A supplied `db.session` or session instance
+remains owned by the host application; the host must close or roll it back.
+Outside a request, close factory-owned sessions with `await datastore.close()`.
+Do not share one session across concurrent tasks.
+
+Password and MFA profile changes rotate the user's `fs_uniquifier`, which rejects
+older authenticated and pending login sessions. Logout revokes the current
+authentication record, including copied cookies for that session. Password
+changes keep the requesting session authenticated. Passkey registration and
+deletion also revoke older sessions. A `secondary` passkey cannot perform
+passwordless sign-in. A primary passkey uses its own user verification and does
+not require the account's TOTP code.
+
+Password helpers now use the current application's settings. Outside an app
+context, pass `app=app`, for example `hash_password(password, app=app)`.
+
+Cookies default to Secure, HttpOnly, and SameSite=Lax. For local HTTP development
+only, set `SECURITY_COOKIE_SECURE=False`. An explicit SameSite value is preserved.
+Use a strong random secret key and explicit RP/origin settings behind proxies.
+The host still needs source-IP and global rate limits; account lockout does not
+limit registration or anonymous challenge generation. Lockout fields are required
+when `SECURITY_LOGIN_MAX_ATTEMPTS` is greater than zero. Setting it to zero
+explicitly disables account lockout.
+
+Custom datastores require a shared `state_store` passed to `Security`. Its async
+methods must implement this contract and propagate storage errors:
+
+| Method | Contract |
+| --- | --- |
+| `put(payload, ttl=seconds, token=None)` | Persist a dictionary with an expiry and return an unpredictable reference. |
+| `get(token)` | Return unexpired state or None. |
+| `pop(token)` | Atomically consume unexpired state; exactly one caller receives it. |
+| `claim(token, ttl=seconds)` | Atomically reserve a key; return False while another unexpired claim exists. |
+
+A process-local dictionary is suitable only for tests. Custom datastores must also
+provide `record_auth_failure(user, max_attempts=..., lockout_minutes=...)` as an
+atomic increment/lock update and
+`replace_recovery_codes(user, expected, remaining)` as an atomic conditional
+replacement returning a boolean. `rotate_uniquifier(user, expected, replacement)`
+must atomically check the old value and persist both the new value and staged
+profile changes. Return False and roll back staged changes when the old value no
+longer matches. Concurrent profile updates return HTTP 409; the user must sign in
+again. Persist these changes before returning. The
+extension fails at initialization if an enabled control lacks its required hook
+or SQLAlchemy model fields.
+
+Dependencies now include the Pillow, bcrypt, and SQLAlchemy asyncio extras and patched
+minimum versions of aiosmtplib, cryptography, and cbor2. The release workflow runs
+lint and tests before building and publishing. CI tests Python 3.11 through 3.14.

{quart_security-1.4.0 → quart_security-2.0.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "flit_core.buildapi"
 
 [project]
 name = "quart-security"
-version = "1.4.0"
+version = "2.0.0"
 description = "Native async auth for Quart"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -14,13 +14,15 @@ authors = [
 ]
 dependencies = [
   "quart>=0.20.0",
-  "sqlalchemy>=2.0",
-  "libpass>=1.9",
+  "sqlalchemy[asyncio]>=2.0",
+  "libpass[bcrypt]>=1.9.3",
   "pyotp>=2.9",
-  "qrcode>=8.0",
+  "qrcode[pil]>=8.0",
   "webauthn>=2.7",
+  "cryptography>=50.0.0",
+  "cbor2>=5.9.0",
   "wtforms>=3.1",
-  "aiosmtplib>=3.0",
+  "aiosmtplib>=5.1.2",
   "blinker>=1.7",
   "email-validator>=2.0",
   "argon2-cffi>=23.1",
@@ -44,6 +46,7 @@ name = "quart_security"
 
 [dependency-groups]
 dev = [
+  "aiosqlite>=0.20",
   "pytest>=8.0",
   "pytest-asyncio>=0.23",
   "respx>=0.23.1",

{quart_security-1.4.0 → quart_security-2.0.0}/quart_security/__init__.py

@@ -18,11 +18,14 @@ from .signals import (
     user_logged_out,
     user_registered,
 )
+from .state import SecurityState, SQLAlchemyStateStore
 from .utils import url_for_security
 
 __all__ = [
     "Security",
     "SQLAlchemyUserDatastore",
+    "SecurityState",
+    "SQLAlchemyStateStore",
     "auth_required",
     "roles_required",
     "UserMixin",

{quart_security-1.4.0 → quart_security-2.0.0}/quart_security/core.py

@@ -2,15 +2,18 @@
 
 from __future__ import annotations
 
-import secrets
+import time
 from datetime import timedelta
+from uuid import uuid4
 
-from quart import current_app, g, request, session
+from quart import abort, current_app, g, request, session
 
+from .datastore import SQLAlchemyUserDatastore
 from .forms import ChangePasswordForm, LoginForm, RegisterForm
 from .password import init_password_context
 from .proxies import AnonymousUser, current_user
 from .signals import user_authenticated, user_logged_out
+from .state import SQLAlchemyStateStore
 from .utils import maybe_await, naive_utcnow, url_for_security
 
 
@@ -53,6 +56,7 @@ class Security:
             "change_password_form", ChangePasswordForm
         )
         self.mail_util_cls = kwargs.get("mail_util_cls")
+        self.state_store = kwargs.get("state_store")
 
         if app is not None:
             self.init_app(app, datastore=datastore, **kwargs)
@@ -70,8 +74,50 @@ class Security:
             "change_password_form", self.change_password_form_cls
         )
         self.mail_util_cls = kwargs.get("mail_util_cls", self.mail_util_cls)
+        self.state_store = kwargs.get("state_store", self.state_store)
+        if self.state_store is None:
+            if not isinstance(self.datastore, SQLAlchemyUserDatastore):
+                raise RuntimeError("Custom datastores require a shared state_store")
+            self.state_store = SQLAlchemyStateStore(self.datastore)
 
         self._load_defaults(app)
+        for name in ("put", "get", "pop", "claim"):
+            if not callable(getattr(self.state_store, name, None)):
+                raise RuntimeError(f"Security state_store requires {name}")
+        required_hooks = ["rotate_uniquifier"]
+        if app.config["SECURITY_LOGIN_MAX_ATTEMPTS"] > 0:
+            required_hooks.append("record_auth_failure")
+        if app.config["SECURITY_MULTI_FACTOR_RECOVERY_CODES"]:
+            required_hooks.append("replace_recovery_codes")
+        for name in required_hooks:
+            if not callable(getattr(self.datastore, name, None)):
+                raise RuntimeError(f"Security requires atomic datastore hook: {name}")
+        if isinstance(self.datastore, SQLAlchemyUserDatastore):
+            required_fields = ["fs_uniquifier", "email", "password", "active"]
+            if app.config["SECURITY_LOGIN_MAX_ATTEMPTS"] > 0:
+                required_fields += ["failed_login_count", "locked_until"]
+            if app.config["SECURITY_TWO_FACTOR"]:
+                required_fields += ["tf_primary_method", "tf_totp_secret"]
+            if app.config["SECURITY_MULTI_FACTOR_RECOVERY_CODES"]:
+                required_fields.append("mf_recovery_codes")
+            if app.config["SECURITY_WEBAUTHN"]:
+                required_fields.append("fs_webauthn_user_handle")
+            missing = [
+                name
+                for name in required_fields
+                if not hasattr(self.datastore.user_model, name)
+            ]
+            if missing:
+                raise RuntimeError(
+                    f"Security user model lacks fields: {', '.join(missing)}"
+                )
+        if not app.secret_key:
+            raise RuntimeError("Security requires SECRET_KEY")
+        app.config["SESSION_COOKIE_SECURE"] = app.config["SECURITY_COOKIE_SECURE"]
+        app.config["SESSION_COOKIE_HTTPONLY"] = True
+        app.config["SESSION_COOKIE_SAMESITE"] = (
+            app.config.get("SESSION_COOKIE_SAMESITE") or "Lax"
+        )
         init_password_context(app)
 
         from .views import security_bp
@@ -85,14 +131,36 @@ class Security:
 
             @app.before_request
             async def _security_load_user():
+                begin = getattr(self.datastore, "begin_request", None)
+                if begin:
+                    begin()
                 await self.load_user()
 
             @app.before_websocket
             async def _security_load_user_ws():
+                begin = getattr(self.datastore, "begin_request", None)
+                if begin:
+                    begin()
                 await self.load_user()
 
+            @app.teardown_request
+            @app.teardown_websocket
+            async def _security_close_session(_exception):
+                close = getattr(self.datastore, "close", None)
+                if close:
+                    await maybe_await(close())
+
             app.extensions["quart_security_load_user_registered"] = True
 
+            if isinstance(self.state_store, SQLAlchemyStateStore):
+
+                @app.before_serving
+                async def _security_validate_state():
+                    try:
+                        await self.state_store.validate()
+                    finally:
+                        await self.datastore.close()
+
         app.jinja_env.globals.setdefault("url_for_security", url_for_security)
 
         if not app.extensions.get("quart_security_context_registered", False):
@@ -137,6 +205,7 @@ class Security:
             "SECURITY_POST_REGISTER_VIEW": "/login",
             "SECURITY_EMAIL_SENDER": "noreply@example.com",
             "SECURITY_CSRF_PROTECT": True,
+            "SECURITY_COOKIE_SECURE": True,
         }
 
         for key, value in defaults.items():
@@ -148,11 +217,23 @@ class Security:
             g._current_user = AnonymousUser()
             return
 
+        state = await self.state_store.get(session.get("_id"))
+        if not state or state.get("user_id") != user_id:
+            session.clear()
+            g._current_user = AnonymousUser()
+            return
+
         user = await maybe_await(self.datastore.find_user(fs_uniquifier=user_id))
-        g._current_user = user or AnonymousUser()
+        if user is None or not getattr(user, "active", True):
+            session.clear()
+            g._current_user = AnonymousUser()
+            return
+        g._current_user = user
 
     async def login_user(self, user, fresh=True):
         app = current_app._get_current_object()
+        if not user.is_active:
+            raise ValueError("Cannot authenticate an inactive user")
 
         user_id = user.get_id() if hasattr(user, "get_id") else None
         if not user_id:
@@ -160,15 +241,6 @@ class Security:
         if not user_id:
             raise RuntimeError("User must have fs_uniquifier/get_id for session login")
 
-        # Regenerate session to prevent fixation: discard pre-login state,
-        # then write only the login keys into a clean session.
-        session.clear()
-        session["_user_id"] = user_id
-        session["_fresh"] = bool(fresh)
-        session["_id"] = secrets.token_hex(16)
-        session.modified = True
-        g._current_user = user
-
         if app.config.get("SECURITY_TRACKABLE", True):
             user.last_login_at = getattr(user, "current_login_at", None)
             user.last_login_ip = getattr(user, "current_login_ip", None)
@@ -177,13 +249,40 @@ class Security:
             user.login_count = (getattr(user, "login_count", None) or 0) + 1
 
         await maybe_await(self.datastore.commit())
+        token = await self.state_store.put(
+            {"user_id": user_id},
+            ttl=int(app.permanent_session_lifetime.total_seconds()),
+        )
+        # Discard pre-login state only after authentication writes succeed.
+        session.clear()
+        session["_user_id"] = user_id
+        session["_fresh"] = bool(fresh)
+        session["_auth_at"] = int(time.time())
+        session["_id"] = token
+        g._current_user = user
         await user_authenticated.send_async(app, user=user, authn_via="session")
 
+    async def revoke_user_sessions(self, user):
+        changed = await maybe_await(
+            self.datastore.rotate_uniquifier(user, user.get_id(), uuid4().hex)
+        )
+        if not changed:
+            session.clear()
+            g._current_user = AnonymousUser()
+            abort(409)
+        await self.state_store.pop(session.get("_id"))
+        session["_user_id"] = user.get_id()
+        session["_id"] = await self.state_store.put(
+            {"user_id": user.get_id()},
+            ttl=int(current_app.permanent_session_lifetime.total_seconds()),
+        )
+
     async def logout_user(self, user=None):
         app = current_app._get_current_object()
         target_user = user or getattr(g, "_current_user", AnonymousUser())
 
         if getattr(target_user, "is_authenticated", False):
+            await self.state_store.pop(session.get("_id"))
             await user_logged_out.send_async(app, user=target_user)
 
         session.clear()