4
\$\begingroup\$

I'm looking to find what security flaws this code might have. I believe it's immune to time attacks, passwords are stored encrypted, and I'm using sessions to store local data.

Let's assume the following:

  • All traffic is over SSL
  • Users have to re-authenticate after 30 minutes of inactivity

Login page:

{% block body %}
   <p>CMS index</p>

   <form id="login" action="/login" method="post">
      <input type="text" name="username" placeholder="Username">
      <input type="password" name="password" placeholder="Password">

      <input type="submit" class="success button" value="Submit">
   </form>

   <form id="createUser" action="/createUser" method="post">
      <input type="text" name="username" placeholder="Username">
      <input type="password" name="password" placeholder="Password">
      <input type="password" name="vPass" placeholder="Verify Password">

      <input type="submit" class="success button" value="Submit">
   </form>

{% endblock %}

Flask app:

@app.route('/cms/')
def cmsHome():
    return render_template('cmsIndex.html')

@app.route('/login', methods = ['POST', 'GET'])
def cmsLogin():
    result = request.form

    user = User()
    sessionId = user.loginUser(result['username'], result['password'])

    if sessionId != False:
        session['id'] = sessionId
        return redirect(url_for('cmsEvents'))
    else:
        return redirect(url_for('cmsHome'))

@app.route('/createUser/', methods = ['POST', 'GET'])
def createUser():
    result = request.form

    user = User()
    check = user.createUser(result['username'], result['password'], result['vPass'])

    if check == True:
        flash('Account created')
    elif check == False:
        flash("Your username/password is too short (3/8) or passwords don't match")

    return redirect(url_for('cmsHome'))

@app.route('/cmsevents/')
@app.route('/cmsevents/<page>')
def cmsEvents(page = 1):
    return "Made it"

Class:

import time, json, requests, pymysql, string, random
from passlib.hash import bcrypt

class User:
    def __init__(self):
        pass

    def createUser(self, username, password, vPass):
        dbm = Database()

        if len(username) < 3:
            return False

        if len(password) < 8:
            return False

        if password != vPass:
            return False

        password = bcrypt.hash(password)

        with dbm.con:
            dbm.cur.execute("INSERT INTO admin.users (username, password) VALUES (%s, %s)", (username, password))

        return True

    def loginUser(self, username, password):
        dbm = Database()

        with dbm.con:
            dbm.cur.execute("SELECT id FROM admin.users WHERE username = %s", (username, ))

            if dbm.cur.rowcount == 1:
                dbm.cur.execute("SELECT password FROM admin.users WHERE username = %s", (username, ))
                fetch = dbm.cur.fetchone()
                check = bcrypt.verify(password, fetch[0])

                if check == True:
                    sessionId = bcrypt.hash(username + ''.join(random.SystemRandom().choice(string.ascii_letters + string.digits) for _ in range(40)))
                    dbm.cur.execute("UPDATE admin.users SET session = %s WHERE username = %s", (sessionId, username))
                    return sessionId
                else:
                    return False
            else:
                return False

    def verifyUser(self, sessionId):
        dbm = Database()

        with dbm.con:
            dbm.cur.execute("SELECT id FROM admin.users WHERE session = %s", (sessionId, ))
            if dbm.cur.rowcount == 1:
                return True
            else:
                return False

I realize this code could use some touching up (properly redirect when there's no session, manage users by id instead of username, etc), but I want to know about any security issues before continuing.

I know about Flask-Login, please don't recommend it. I'm doing this by hand for the learning experience.

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.