pyskell / licenseserver Goto Github PK

I would not trust the randomness of this function. You should use this module instead: https://docs.python.org/3/library/secrets.html#module-secrets.

This is vulnerable to a timing attack, Use a constant time comparison function or https://docs.python.org/3.6/library/hmac.html#hmac.compare_digest

I see you listed passlib as a requirement but you aren't using it, which supports sha256_crypt and it generates a salt for you, and includes a constant time comparison function. This would solve both of the above issues.

I noticed that under very high server load, opening a session for the SQL database using
session = Session(engine)
for example in validate, where the kw autoflush is True by default, caused some stability issues. Could turning auto flush off using
session = Session(engine,autoflush=False)
cause any other unexpected issues? It seems to fix the problem I observed.