security update

auth.py

@@ -1,64 +1,35 @@
-from flask import Blueprint, render_template, request, redirect, url_for, flash, make_response
+from flask import Blueprint, render_template, request, redirect, url_for, flash, make_response, current_app
 from flask_login import login_user, logout_user, login_required, current_user
 from models import db
 from models import User
 from log import Log
-import pickle
-from cryptography.fernet import Fernet
-import datetime
+from itsdangerous import BadSignature, SignatureExpired, URLSafeTimedSerializer
 
 
 auth_bp = Blueprint("auth", __name__)
 
-# =====================================================
-# SECRET KEY (only for this program)
-# =====================================================
-# Generate once using: Fernet.generate_key()
-_SECRET_KEY = b'YFK7QCyTzhyLO4vqrnRxvDAI5uu8mXEYrInEjbRoQgs='
-fernet = Fernet(_SECRET_KEY)
+AUTOLOGIN_MAX_AGE_SECONDS = 7 * 24 * 60 * 60
+AUTOLOGIN_SALT = "lapp-autologin"
 
-# =====================================================
-# ENCRYPT
-# =====================================================
-def encrypt_object(obj) -> bytes:
-    """
-    Encrypt any Python object and return encrypted bytes.
-    """
-    serialized = pickle.dumps(obj)
-    encrypted = fernet.encrypt(serialized)
-    return encrypted
-
-# =====================================================
-# DECRYPT
-# =====================================================
-def decrypt_object(encrypted_data: bytes):
-    """
-    Decrypt bytes back into the original Python object.
-    """
-    decrypted = fernet.decrypt(encrypted_data)
-    obj = pickle.loads(decrypted)
-    return obj
+def autologin_serializer():
+    return URLSafeTimedSerializer(current_app.config["SECRET_KEY"], salt=AUTOLOGIN_SALT)
 
 def create_cookie(userid):
     cookie_data = {
-        "user": userid,
-        "datetime": datetime.datetime.now()
+        "user": userid
     }
-    return encrypt_object(cookie_data).decode('utf-8')
+    return autologin_serializer().dumps(cookie_data)
 
 def is_cookie_ok_to_autologin(cookie_content):
-    user = 0
-    autologin = False
+    if not cookie_content:
+        return 0
+
     try:
-        cookie_data = decrypt_object(cookie_content)
-        user = cookie_data["user"]
-        dt = cookie_data["datetime"]
-        lastweek = datetime.datetime.now() - datetime.timedelta(days=7)
-        autologin = dt > lastweek
-    except:
+        cookie_data = autologin_serializer().loads(cookie_content,
+                                                   max_age=AUTOLOGIN_MAX_AGE_SECONDS)
+        return int(cookie_data["user"])
+    except (BadSignature, SignatureExpired, KeyError, TypeError, ValueError):
         Log.info("Cookie error")
-    if autologin:
-        return user
     return 0
 
 #. @auth_bp.route("/", methods=["GET", "POST"])

initialize_data.py

@@ -7,7 +7,6 @@ if __name__ == "__main__":
     app.app_context().push()
     query = sa.select(User)
     users = db.session.scalars(query).all()
-    print(users)
     if len(users) == 0:
         g = Group(secret="This is the group just for the admin")
         db.session.add(g)