quart-security 1.4.1__tar.gz → 2.0.1__tar.gz

{quart_security-1.4.1 → quart_security-2.0.1}/PKG-INFO

@@ -1,19 +1,21 @@
 Metadata-Version: 2.4
 Name: quart-security
-Version: 1.4.1
+Version: 2.0.1
 Summary: Native async auth for Quart
 Author: quart-security maintainers
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: quart>=0.20.0
-Requires-Dist: sqlalchemy>=2.0
-Requires-Dist: libpass>=1.9
+Requires-Dist: sqlalchemy[asyncio]>=2.0
+Requires-Dist: libpass[bcrypt]>=1.9.3
 Requires-Dist: pyotp>=2.9
-Requires-Dist: qrcode>=8.0
+Requires-Dist: qrcode[pil]>=8.0
 Requires-Dist: webauthn>=2.7
+Requires-Dist: cryptography>=50.0.0
+Requires-Dist: cbor2>=5.9.0
 Requires-Dist: wtforms>=3.1
-Requires-Dist: aiosmtplib>=3.0
+Requires-Dist: aiosmtplib>=5.1.2
 Requires-Dist: blinker>=1.7
 Requires-Dist: email-validator>=2.0
 Requires-Dist: argon2-cffi>=23.1
@@ -89,7 +91,9 @@ Package build backend: `flit`.
 from quart import Quart
 from quart_security import Security, SQLAlchemyUserDatastore
 
-# your models should include fields used by auth, roles, and MFA/WebAuthn
+import os
+
+# Models must include the fields required by enabled features.
 from myapp.models import db, User, Role, WebAuthnCredential
 
 
@@ -97,8 +101,7 @@ def create_app():
     app = Quart(__name__)
 
     app.config.update(
-        SECRET_KEY="change-me",
-        SECURITY_PASSWORD_SALT="change-me-too",
+        SECRET_KEY=os.environ["SECRET_KEY"],
         SECURITY_POST_LOGIN_VIEW="/dashboard",
         SECURITY_POST_REGISTER_VIEW="/login",
     )
@@ -132,7 +135,7 @@ For tracking / MFA / WebAuthn features:
 - `fs_webauthn_user_handle`
 - relationship/association for stored WebAuthn credentials
 
-Optional for lockout support:
+Required for the default lockout policy:
 - `failed_login_count`
 - `locked_until`
 
@@ -140,13 +143,17 @@ These fields are required when login or MFA lockout is enabled. The built-in
 counter limits account-level guesses. Deploy an application or edge rate limiter
 for source IP and distributed abuse controls.
 
+The database must enforce unique normalized emails, `fs_uniquifier` values,
+WebAuthn user handles, and credential IDs. Use a stable primary key separate from
+`fs_uniquifier`: this value changes when security settings change.
+
 ## Key Configuration
 
 The extension uses `SECURITY_*` keys for migration-friendly configuration.
 
 Core:
 - `SECURITY_PASSWORD_HASH` (default: `argon2` / argon2id; set to `pbkdf2_sha512` to keep old behavior)
-- `SECURITY_PASSWORD_SALT` (recommended)
+- `SECURITY_PASSWORD_SALT` (legacy salted-hash verification only)
 - `SECURITY_PASSWORD_LENGTH_MIN` (default: `12`)
 - `SECURITY_PASSWORD_BREACH_CHECK` (default: `True`) - HIBP k-anonymity check on register/change
 - `SECURITY_PASSWORD_BREACH_COUNT_MIN` (default: `1`) - minimum breach count to reject
@@ -157,6 +164,7 @@ Core:
 - `SECURITY_CHANGEABLE`
 - `SECURITY_TRACKABLE`
 - `SECURITY_CSRF_PROTECT` (default: `True`)
+- `SECURITY_COOKIE_SECURE` (default: `True`; sets `SESSION_COOKIE_SECURE`)
 - `SECURITY_FRESHNESS` (default: `60` minutes)
 
 Existing pbkdf2_sha512 and bcrypt hashes continue to verify after the argon2 default change. They are transparently rehashed to argon2id on the user's next successful login.
@@ -171,6 +179,10 @@ Recovery codes are displayed only when generated and are stored as keyed hashes.
 Existing plaintext codes remain valid until their next successful use, when the
 remaining codes are migrated.
 
+Accepted TOTP time steps, recovery codes, and WebAuthn challenges cannot be reused.
+Disabling an authenticator requires a current TOTP or unused recovery code.
+Wait for the next TOTP code if the current one was just used to sign in.
+
 WebAuthn:
 - `SECURITY_WEBAUTHN`
 - `SECURITY_WAN_ALLOW_AS_FIRST_FACTOR`
@@ -268,3 +280,88 @@ Run this in a HTTPS staging environment with production-like hostnames and real
 - Set explicit WebAuthn RP values (`SECURITY_WAN_RP_ID`, `SECURITY_WAN_EXPECTED_ORIGIN`) when behind proxies or multiple domains.
 - Keep CSRF protection enabled unless you have a deliberate replacement.
 
+## Version 2.0.0 migration
+
+This update requires a shared `quart_security_state` table. It stores expiring
+authentication records and verification state. Cookie contents contain opaque
+references, not pending authenticator secrets. All workers must use the same
+database. Existing login cookies are rejected after this update.
+
+Create the table through your application's database migration before deploying
+the new library. For example, in an Alembic migration:
+
+```python
+from alembic import op
+from quart_security import SecurityState
+
+
+def upgrade():
+    SecurityState.__table__.create(op.get_bind())
+```
+
+This includes the expiry index. Startup checks that the table is present. Protect
+database access and backups because pending TOTP secrets are stored there.
+Expired records are removed when new state is written. Maintenance jobs can also
+call `await security.state_store.purge_expired()` in an application context and
+close the datastore after the job.
+
+For a session factory, use `async_sessionmaker(engine, expire_on_commit=False)`.
+The library retains the session through commits and closes factory-owned sessions
+at the end of each HTTP request or WebSocket connection. Read-only and failed
+requests also close their sessions. A supplied `db.session` or session instance
+remains owned by the host application; the host must close or roll it back.
+Outside a request, close factory-owned sessions with `await datastore.close()`.
+Do not share one session across concurrent tasks.
+
+Password and MFA profile changes rotate the user's `fs_uniquifier`, which rejects
+older authenticated and pending login sessions. Logout revokes the current
+authentication record, including copied cookies for that session. Password
+changes keep the requesting session authenticated. Passkey registration and
+deletion also revoke older sessions. A `secondary` passkey cannot perform
+passwordless sign-in. A primary passkey uses its own user verification and does
+not require the account's TOTP code.
+
+Password helpers now use the current application's settings. Outside an app
+context, pass `app=app`, for example `hash_password(password, app=app)`.
+
+Cookies default to Secure, HttpOnly, and SameSite=Lax. For local HTTP development
+only, set `SECURITY_COOKIE_SECURE=False`. An explicit SameSite value is preserved.
+Use a strong random secret key and explicit RP/origin settings behind proxies.
+The host still needs source-IP and global rate limits; account lockout does not
+limit registration or anonymous challenge generation. Lockout fields are required
+when `SECURITY_LOGIN_MAX_ATTEMPTS` is greater than zero. Setting it to zero
+explicitly disables account lockout.
+
+Custom datastores require a shared `state_store` passed to `Security`. Its async
+methods must implement this contract and propagate storage errors:
+
+| Method | Contract |
+| --- | --- |
+| `put(payload, ttl=seconds, token=None)` | Persist a dictionary with an expiry and return an unpredictable reference. |
+| `get(token)` | Return unexpired state or None. |
+| `pop(token)` | Atomically consume unexpired state; exactly one caller receives it. |
+| `claim(token, ttl=seconds)` | Atomically reserve a key; return False while another unexpired claim exists. |
+
+A process-local dictionary is suitable only for tests. Custom datastores must also
+provide `record_auth_failure(user, max_attempts=..., lockout_minutes=...)` as an
+atomic increment/lock update and
+`replace_recovery_codes(user, expected, remaining)` as an atomic conditional
+replacement returning a boolean. `rotate_uniquifier(user, expected, replacement)`
+must atomically check the old value and persist both the new value and staged
+profile changes. Return False and roll back staged changes when the old value no
+longer matches. Concurrent profile updates return HTTP 409; the user must sign in
+again. Persist these changes before returning. The
+extension fails at initialization if an enabled control lacks its required hook
+or SQLAlchemy model fields.
+
+Dependencies now include the Pillow, bcrypt, and SQLAlchemy asyncio extras and patched
+minimum versions of aiosmtplib, cryptography, and cbor2. The release workflow runs
+lint and tests before building and publishing. CI tests Python 3.11 through 3.14.
+
+
+## TOTP encryption and key rotation
+
+Version 2.0.1 encrypts enrolled TOTP seeds and pending setup secrets with authenticated Fernet encryption. Legacy plaintext seeds remain readable and are encrypted on successful login or an authenticated request. Hosts should encrypt dormant records during upgrade using `encrypt_totp_secret(value, app=app)`. This requires no schema change for a 255-character seed column.
+
+By default, the key is derived from `SECRET_KEY` with a separate purpose label. Keep that key stable. For independent rotation, configure `SECURITY_TOTP_ENCRYPTION_KEYS` as a nonempty list of Fernet keys. The first key encrypts new data; all keys can decrypt existing data. Retain old keys while rotating existing seeds with `encrypt_totp_secret`, including active pending setup states until their five-minute expiry. Remove old keys only after all data and required backups have been handled. Never rotate `SECRET_KEY` without preserving the derived MFA key if using the default. `derive_totp_encryption_key(old_secret_key)` supplies that key for an explicit keyring. Protect the keyring separately from database backups.
+

{quart_security-1.4.1 → quart_security-2.0.1}/README.md

@@ -61,7 +61,9 @@ Package build backend: `flit`.
 from quart import Quart
 from quart_security import Security, SQLAlchemyUserDatastore
 
-# your models should include fields used by auth, roles, and MFA/WebAuthn
+import os
+
+# Models must include the fields required by enabled features.
 from myapp.models import db, User, Role, WebAuthnCredential
 
 
@@ -69,8 +71,7 @@ def create_app():
     app = Quart(__name__)
 
     app.config.update(
-        SECRET_KEY="change-me",
-        SECURITY_PASSWORD_SALT="change-me-too",
+        SECRET_KEY=os.environ["SECRET_KEY"],
         SECURITY_POST_LOGIN_VIEW="/dashboard",
         SECURITY_POST_REGISTER_VIEW="/login",
     )
@@ -104,7 +105,7 @@ For tracking / MFA / WebAuthn features:
 - `fs_webauthn_user_handle`
 - relationship/association for stored WebAuthn credentials
 
-Optional for lockout support:
+Required for the default lockout policy:
 - `failed_login_count`
 - `locked_until`
 
@@ -112,13 +113,17 @@ These fields are required when login or MFA lockout is enabled. The built-in
 counter limits account-level guesses. Deploy an application or edge rate limiter
 for source IP and distributed abuse controls.
 
+The database must enforce unique normalized emails, `fs_uniquifier` values,
+WebAuthn user handles, and credential IDs. Use a stable primary key separate from
+`fs_uniquifier`: this value changes when security settings change.
+
 ## Key Configuration
 
 The extension uses `SECURITY_*` keys for migration-friendly configuration.
 
 Core:
 - `SECURITY_PASSWORD_HASH` (default: `argon2` / argon2id; set to `pbkdf2_sha512` to keep old behavior)
-- `SECURITY_PASSWORD_SALT` (recommended)
+- `SECURITY_PASSWORD_SALT` (legacy salted-hash verification only)
 - `SECURITY_PASSWORD_LENGTH_MIN` (default: `12`)
 - `SECURITY_PASSWORD_BREACH_CHECK` (default: `True`) - HIBP k-anonymity check on register/change
 - `SECURITY_PASSWORD_BREACH_COUNT_MIN` (default: `1`) - minimum breach count to reject
@@ -129,6 +134,7 @@ Core:
 - `SECURITY_CHANGEABLE`
 - `SECURITY_TRACKABLE`
 - `SECURITY_CSRF_PROTECT` (default: `True`)
+- `SECURITY_COOKIE_SECURE` (default: `True`; sets `SESSION_COOKIE_SECURE`)
 - `SECURITY_FRESHNESS` (default: `60` minutes)
 
 Existing pbkdf2_sha512 and bcrypt hashes continue to verify after the argon2 default change. They are transparently rehashed to argon2id on the user's next successful login.
@@ -143,6 +149,10 @@ Recovery codes are displayed only when generated and are stored as keyed hashes.
 Existing plaintext codes remain valid until their next successful use, when the
 remaining codes are migrated.
 
+Accepted TOTP time steps, recovery codes, and WebAuthn challenges cannot be reused.
+Disabling an authenticator requires a current TOTP or unused recovery code.
+Wait for the next TOTP code if the current one was just used to sign in.
+
 WebAuthn:
 - `SECURITY_WEBAUTHN`
 - `SECURITY_WAN_ALLOW_AS_FIRST_FACTOR`
@@ -239,3 +249,88 @@ Run this in a HTTPS staging environment with production-like hostnames and real
 - Run behind HTTPS for WebAuthn in non-local environments.
 - Set explicit WebAuthn RP values (`SECURITY_WAN_RP_ID`, `SECURITY_WAN_EXPECTED_ORIGIN`) when behind proxies or multiple domains.
 - Keep CSRF protection enabled unless you have a deliberate replacement.
+
+## Version 2.0.0 migration
+
+This update requires a shared `quart_security_state` table. It stores expiring
+authentication records and verification state. Cookie contents contain opaque
+references, not pending authenticator secrets. All workers must use the same
+database. Existing login cookies are rejected after this update.
+
+Create the table through your application's database migration before deploying
+the new library. For example, in an Alembic migration:
+
+```python
+from alembic import op
+from quart_security import SecurityState
+
+
+def upgrade():
+    SecurityState.__table__.create(op.get_bind())
+```
+
+This includes the expiry index. Startup checks that the table is present. Protect
+database access and backups because pending TOTP secrets are stored there.
+Expired records are removed when new state is written. Maintenance jobs can also
+call `await security.state_store.purge_expired()` in an application context and
+close the datastore after the job.
+
+For a session factory, use `async_sessionmaker(engine, expire_on_commit=False)`.
+The library retains the session through commits and closes factory-owned sessions
+at the end of each HTTP request or WebSocket connection. Read-only and failed
+requests also close their sessions. A supplied `db.session` or session instance
+remains owned by the host application; the host must close or roll it back.
+Outside a request, close factory-owned sessions with `await datastore.close()`.
+Do not share one session across concurrent tasks.
+
+Password and MFA profile changes rotate the user's `fs_uniquifier`, which rejects
+older authenticated and pending login sessions. Logout revokes the current
+authentication record, including copied cookies for that session. Password
+changes keep the requesting session authenticated. Passkey registration and
+deletion also revoke older sessions. A `secondary` passkey cannot perform
+passwordless sign-in. A primary passkey uses its own user verification and does
+not require the account's TOTP code.
+
+Password helpers now use the current application's settings. Outside an app
+context, pass `app=app`, for example `hash_password(password, app=app)`.
+
+Cookies default to Secure, HttpOnly, and SameSite=Lax. For local HTTP development
+only, set `SECURITY_COOKIE_SECURE=False`. An explicit SameSite value is preserved.
+Use a strong random secret key and explicit RP/origin settings behind proxies.
+The host still needs source-IP and global rate limits; account lockout does not
+limit registration or anonymous challenge generation. Lockout fields are required
+when `SECURITY_LOGIN_MAX_ATTEMPTS` is greater than zero. Setting it to zero
+explicitly disables account lockout.
+
+Custom datastores require a shared `state_store` passed to `Security`. Its async
+methods must implement this contract and propagate storage errors:
+
+| Method | Contract |
+| --- | --- |
+| `put(payload, ttl=seconds, token=None)` | Persist a dictionary with an expiry and return an unpredictable reference. |
+| `get(token)` | Return unexpired state or None. |
+| `pop(token)` | Atomically consume unexpired state; exactly one caller receives it. |
+| `claim(token, ttl=seconds)` | Atomically reserve a key; return False while another unexpired claim exists. |
+
+A process-local dictionary is suitable only for tests. Custom datastores must also
+provide `record_auth_failure(user, max_attempts=..., lockout_minutes=...)` as an
+atomic increment/lock update and
+`replace_recovery_codes(user, expected, remaining)` as an atomic conditional
+replacement returning a boolean. `rotate_uniquifier(user, expected, replacement)`
+must atomically check the old value and persist both the new value and staged
+profile changes. Return False and roll back staged changes when the old value no
+longer matches. Concurrent profile updates return HTTP 409; the user must sign in
+again. Persist these changes before returning. The
+extension fails at initialization if an enabled control lacks its required hook
+or SQLAlchemy model fields.
+
+Dependencies now include the Pillow, bcrypt, and SQLAlchemy asyncio extras and patched
+minimum versions of aiosmtplib, cryptography, and cbor2. The release workflow runs
+lint and tests before building and publishing. CI tests Python 3.11 through 3.14.
+
+
+## TOTP encryption and key rotation
+
+Version 2.0.1 encrypts enrolled TOTP seeds and pending setup secrets with authenticated Fernet encryption. Legacy plaintext seeds remain readable and are encrypted on successful login or an authenticated request. Hosts should encrypt dormant records during upgrade using `encrypt_totp_secret(value, app=app)`. This requires no schema change for a 255-character seed column.
+
+By default, the key is derived from `SECRET_KEY` with a separate purpose label. Keep that key stable. For independent rotation, configure `SECURITY_TOTP_ENCRYPTION_KEYS` as a nonempty list of Fernet keys. The first key encrypts new data; all keys can decrypt existing data. Retain old keys while rotating existing seeds with `encrypt_totp_secret`, including active pending setup states until their five-minute expiry. Remove old keys only after all data and required backups have been handled. Never rotate `SECRET_KEY` without preserving the derived MFA key if using the default. `derive_totp_encryption_key(old_secret_key)` supplies that key for an explicit keyring. Protect the keyring separately from database backups.

{quart_security-1.4.1 → quart_security-2.0.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "flit_core.buildapi"
 
 [project]
 name = "quart-security"
-version = "1.4.1"
+version = "2.0.1"
 description = "Native async auth for Quart"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -14,13 +14,15 @@ authors = [
 ]
 dependencies = [
   "quart>=0.20.0",
-  "sqlalchemy>=2.0",
-  "libpass>=1.9",
+  "sqlalchemy[asyncio]>=2.0",
+  "libpass[bcrypt]>=1.9.3",
   "pyotp>=2.9",
-  "qrcode>=8.0",
+  "qrcode[pil]>=8.0",
   "webauthn>=2.7",
+  "cryptography>=50.0.0",
+  "cbor2>=5.9.0",
   "wtforms>=3.1",
-  "aiosmtplib>=3.0",
+  "aiosmtplib>=5.1.2",
   "blinker>=1.7",
   "email-validator>=2.0",
   "argon2-cffi>=23.1",
@@ -44,6 +46,7 @@ name = "quart_security"
 
 [dependency-groups]
 dev = [
+  "aiosqlite>=0.20",
   "pytest>=8.0",
   "pytest-asyncio>=0.23",
   "respx>=0.23.1",

{quart_security-1.4.1 → quart_security-2.0.1}/quart_security/__init__.py

@@ -18,11 +18,14 @@ from .signals import (
     user_logged_out,
     user_registered,
 )
+from .state import SecurityState, SQLAlchemyStateStore
 from .utils import url_for_security
 
 __all__ = [
     "Security",
     "SQLAlchemyUserDatastore",
+    "SecurityState",
+    "SQLAlchemyStateStore",
     "auth_required",
     "roles_required",
     "UserMixin",

{quart_security-1.4.1 → quart_security-2.0.1}/quart_security/core.py

@@ -2,16 +2,19 @@
 
 from __future__ import annotations
 
-import secrets
 import time
 from datetime import timedelta
+from uuid import uuid4
 
-from quart import current_app, g, request, session
+from quart import abort, current_app, g, request, session
 
+from .datastore import SQLAlchemyUserDatastore
 from .forms import ChangePasswordForm, LoginForm, RegisterForm
 from .password import init_password_context
 from .proxies import AnonymousUser, current_user
 from .signals import user_authenticated, user_logged_out
+from .state import SQLAlchemyStateStore
+from .totp import encrypt_totp_secret, init_totp_encryption
 from .utils import maybe_await, naive_utcnow, url_for_security
 
 
@@ -54,6 +57,7 @@ class Security:
             "change_password_form", ChangePasswordForm
         )
         self.mail_util_cls = kwargs.get("mail_util_cls")
+        self.state_store = kwargs.get("state_store")
 
         if app is not None:
             self.init_app(app, datastore=datastore, **kwargs)
@@ -71,9 +75,52 @@ class Security:
             "change_password_form", self.change_password_form_cls
         )
         self.mail_util_cls = kwargs.get("mail_util_cls", self.mail_util_cls)
+        self.state_store = kwargs.get("state_store", self.state_store)
+        if self.state_store is None:
+            if not isinstance(self.datastore, SQLAlchemyUserDatastore):
+                raise RuntimeError("Custom datastores require a shared state_store")
+            self.state_store = SQLAlchemyStateStore(self.datastore)
 
         self._load_defaults(app)
+        for name in ("put", "get", "pop", "claim"):
+            if not callable(getattr(self.state_store, name, None)):
+                raise RuntimeError(f"Security state_store requires {name}")
+        required_hooks = ["rotate_uniquifier"]
+        if app.config["SECURITY_LOGIN_MAX_ATTEMPTS"] > 0:
+            required_hooks.append("record_auth_failure")
+        if app.config["SECURITY_MULTI_FACTOR_RECOVERY_CODES"]:
+            required_hooks.append("replace_recovery_codes")
+        for name in required_hooks:
+            if not callable(getattr(self.datastore, name, None)):
+                raise RuntimeError(f"Security requires atomic datastore hook: {name}")
+        if isinstance(self.datastore, SQLAlchemyUserDatastore):
+            required_fields = ["fs_uniquifier", "email", "password", "active"]
+            if app.config["SECURITY_LOGIN_MAX_ATTEMPTS"] > 0:
+                required_fields += ["failed_login_count", "locked_until"]
+            if app.config["SECURITY_TWO_FACTOR"]:
+                required_fields += ["tf_primary_method", "tf_totp_secret"]
+            if app.config["SECURITY_MULTI_FACTOR_RECOVERY_CODES"]:
+                required_fields.append("mf_recovery_codes")
+            if app.config["SECURITY_WEBAUTHN"]:
+                required_fields.append("fs_webauthn_user_handle")
+            missing = [
+                name
+                for name in required_fields
+                if not hasattr(self.datastore.user_model, name)
+            ]
+            if missing:
+                raise RuntimeError(
+                    f"Security user model lacks fields: {', '.join(missing)}"
+                )
+        if not app.secret_key:
+            raise RuntimeError("Security requires SECRET_KEY")
+        app.config["SESSION_COOKIE_SECURE"] = app.config["SECURITY_COOKIE_SECURE"]
+        app.config["SESSION_COOKIE_HTTPONLY"] = True
+        app.config["SESSION_COOKIE_SAMESITE"] = (
+            app.config.get("SESSION_COOKIE_SAMESITE") or "Lax"
+        )
         init_password_context(app)
+        init_totp_encryption(app)
 
         from .views import security_bp
 
@@ -86,14 +133,36 @@ class Security:
 
             @app.before_request
             async def _security_load_user():
+                begin = getattr(self.datastore, "begin_request", None)
+                if begin:
+                    begin()
                 await self.load_user()
 
             @app.before_websocket
             async def _security_load_user_ws():
+                begin = getattr(self.datastore, "begin_request", None)
+                if begin:
+                    begin()
                 await self.load_user()
 
+            @app.teardown_request
+            @app.teardown_websocket
+            async def _security_close_session(_exception):
+                close = getattr(self.datastore, "close", None)
+                if close:
+                    await maybe_await(close())
+
             app.extensions["quart_security_load_user_registered"] = True
 
+            if isinstance(self.state_store, SQLAlchemyStateStore):
+
+                @app.before_serving
+                async def _security_validate_state():
+                    try:
+                        await self.state_store.validate()
+                    finally:
+                        await self.datastore.close()
+
         app.jinja_env.globals.setdefault("url_for_security", url_for_security)
 
         if not app.extensions.get("quart_security_context_registered", False):
@@ -138,6 +207,7 @@ class Security:
             "SECURITY_POST_REGISTER_VIEW": "/login",
             "SECURITY_EMAIL_SENDER": "noreply@example.com",
             "SECURITY_CSRF_PROTECT": True,
+            "SECURITY_COOKIE_SECURE": True,
         }
 
         for key, value in defaults.items():
@@ -149,15 +219,28 @@ class Security:
             g._current_user = AnonymousUser()
             return
 
+        state = await self.state_store.get(session.get("_id"))
+        if not state or state.get("user_id") != user_id:
+            session.clear()
+            g._current_user = AnonymousUser()
+            return
+
         user = await maybe_await(self.datastore.find_user(fs_uniquifier=user_id))
         if user is None or not getattr(user, "active", True):
             session.clear()
             g._current_user = AnonymousUser()
             return
+        if getattr(user, "tf_totp_secret", None) and not user.tf_totp_secret.startswith(
+            "fernet$"
+        ):
+            user.tf_totp_secret = encrypt_totp_secret(user.tf_totp_secret)
+            await maybe_await(self.datastore.commit())
         g._current_user = user
 
     async def login_user(self, user, fresh=True):
         app = current_app._get_current_object()
+        if not user.is_active:
+            raise ValueError("Cannot authenticate an inactive user")
 
         user_id = user.get_id() if hasattr(user, "get_id") else None
         if not user_id:
@@ -165,16 +248,6 @@ class Security:
         if not user_id:
             raise RuntimeError("User must have fs_uniquifier/get_id for session login")
 
-        # Regenerate session to prevent fixation: discard pre-login state,
-        # then write only the login keys into a clean session.
-        session.clear()
-        session["_user_id"] = user_id
-        session["_fresh"] = bool(fresh)
-        session["_auth_at"] = int(time.time())
-        session["_id"] = secrets.token_hex(16)
-        session.modified = True
-        g._current_user = user
-
         if app.config.get("SECURITY_TRACKABLE", True):
             user.last_login_at = getattr(user, "current_login_at", None)
             user.last_login_ip = getattr(user, "current_login_ip", None)
@@ -182,14 +255,45 @@ class Security:
             user.current_login_ip = request.remote_addr
             user.login_count = (getattr(user, "login_count", None) or 0) + 1
 
+        if getattr(user, "tf_totp_secret", None) and not user.tf_totp_secret.startswith(
+            "fernet$"
+        ):
+            user.tf_totp_secret = encrypt_totp_secret(user.tf_totp_secret)
         await maybe_await(self.datastore.commit())
+        token = await self.state_store.put(
+            {"user_id": user_id},
+            ttl=int(app.permanent_session_lifetime.total_seconds()),
+        )
+        # Discard pre-login state only after authentication writes succeed.
+        session.clear()
+        session["_user_id"] = user_id
+        session["_fresh"] = bool(fresh)
+        session["_auth_at"] = int(time.time())
+        session["_id"] = token
+        g._current_user = user
         await user_authenticated.send_async(app, user=user, authn_via="session")
 
+    async def revoke_user_sessions(self, user):
+        changed = await maybe_await(
+            self.datastore.rotate_uniquifier(user, user.get_id(), uuid4().hex)
+        )
+        if not changed:
+            session.clear()
+            g._current_user = AnonymousUser()
+            abort(409)
+        await self.state_store.pop(session.get("_id"))
+        session["_user_id"] = user.get_id()
+        session["_id"] = await self.state_store.put(
+            {"user_id": user.get_id()},
+            ttl=int(current_app.permanent_session_lifetime.total_seconds()),
+        )
+
     async def logout_user(self, user=None):
         app = current_app._get_current_object()
         target_user = user or getattr(g, "_current_user", AnonymousUser())
 
         if getattr(target_user, "is_authenticated", False):
+            await self.state_store.pop(session.get("_id"))
             await user_logged_out.send_async(app, user=target_user)
 
         session.clear()