Comments (17)
The data is actually not encrypted when it is passed into itsdangerous. It's serialized and signed. The signature is also included in the token because it can be used to verify that the token was generated by the server and not some random joe on the internet.
The thing that's keeping the token from being generated is the fact that it is signed using the secret key. If the secret key is exposed, then none of the id, email, or a timestamp will stop that from being exploited (timestamps are generally super easy to guess).
from explore-flask.
After reading through this, I think it can be closed as a misunderstanding of how the design works by the OP.
from explore-flask.
This seems to make sense. I need to spend a few minutes looking into it. Thanks for bringing it to my attention.
from explore-flask.
let me know if you'd like some example code
from explore-flask.
As a side note: send_email
isn't referencing Flask-Mail, just a generic method to send an email.
from explore-flask.
Could you explain the attack vector a little more to me? Are you saying that multiple accounts might be attached to the same email address?
from explore-flask.
So that someone does not just start generating tokens. If s/he doesn't have
the id then all is well.
On Mon, Dec 8, 2014 at 12:52 PM, Robert Picard [email protected]
wrote:
Could you explain the attack vector a little more to me? Are you saying
that multiple accounts might be attached to the same email address?—
Reply to this email directly or view it on GitHub
#77 (comment)
.
from explore-flask.
itsdangerous uses the application secret to sign the tokens. I just went looking through the code to confirm, and yeah it's signing them with HMAC SHA256 by default. This is what keeps me from making tokens for other users.
It uses the value passed in when the URLSafeTimedSerializer
is initialized. We're doing this with the application secret at line 7 in the first code block here https://exploreflask.com/users.html#email-confirmation.
It's also worth noting that the user id is not a secret value. They are usually easy to guess or revealed in URLs and other places.
If I'm mistaken on any of this please let me know, though.
from explore-flask.
Use both. Then do a final check with the id.
On Tue, Dec 9, 2014 at 9:52 AM, Robert Picard [email protected]
wrote:
itsdangerous uses the application secret to sign the tokens. I just went
looking through the code to confirm, and yeah it's signing them with HMAC
SHA256 by default.It uses the value passed in when the URLSafeTimedSerializer is
initialized. We're doing this with the application secret at line 7 in the
first code block here
https://exploreflask.com/users.html#email-confirmation.It's also worth noting that the user id is not a secret value. They are
usually easy to guess or revealed in URLs and other places.—
Reply to this email directly or view it on GitHub
#77 (comment)
.
from explore-flask.
I think I'm misunderstanding still. What security benefit do you get by including the id?
from explore-flask.
let's say someone figures out how to generate a correct token. if the id is
in there as well, it can be used as a final confirmation. so you verify
email and then id. it's just added secerity.
On Tue, Dec 9, 2014 at 11:27 AM, Robert Picard [email protected]
wrote:
I think I'm misunderstanding still. What security benefit do you get by
including the id?—
Reply to this email directly or view it on GitHub
#77 (comment)
.
from explore-flask.
What's to stop them from including the id in the forged token?
If they can generate a correct token it's game over.
from explore-flask.
I'm not explaining this very well. Let me show you an example.
On Tue, Dec 9, 2014 at 11:30 AM, Robert Picard [email protected]
wrote:
What's to stop them from including the id in the forged token?
If they can generate a correct token it's game over.
—
Reply to this email directly or view it on GitHub
#77 (comment)
.
from explore-flask.
Sounds good. 👍
from explore-flask.
Okay. Here are my thoughts -
Since the user knows that the encrypted data is just the email, if the salt is hard coded, they could get the secret key. That's one problem. The second is that if you just encode the user id, you would have the same issue since it is sequential. I think it's best to use the user id, email, along with a timestamp.
Thoughts?
from explore-flask.
@rpicard Great book! Can you provide an example for send_email
? Perhaps using Flask-Mail or whatever you think is most useful? Would this work?
from explore-flask.
@jeffwidman Yeah, I think you're right.
As for the send_email
stuff, there are a million ways to implement it. I personally like using an email service like Mailgun or Amazon SES because it feels easier. I'm going to close this out, but feel free to open a different issue if you have more questions. I'm not always prompt about answering, but I'll try to help. :)
from explore-flask.
Related Issues (20)
- Small typo in comment in blueprints HOT 1
- What is Listing~ ?? HOT 1
- A problem with Blueprints subdomain setup HOT 1
- there's a typo
- Password Setter procedure has changed HOT 2
- Hyperlink issue in environment page HOT 1
- Great work! Great book about flask HOT 1
- Syntax highlight HOT 2
- Book Translation HOT 3
- Links errors on environment.html
- Form chapter: Unique validator missing init message
- Handling Users HOT 3
- [preface] the Youtube link is dead
- `import .views` in blueprinst.rst HOT 2
- Add translations HOT 3
- Question about 'Patterns for handling users' HOT 2
- Broken links in online version when url is not appended with /en/latest HOT 3
- Configuration - Flask-SQLAlchemy link is dead HOT 1
- Something wrong with tables.
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from explore-flask.