implemented optional authentification app and stricter password and user rules.
Also against brute force.
This commit is contained in:
Binary file not shown.
Binary file not shown.
+462
-23
@@ -1,30 +1,291 @@
|
||||
from flask import Blueprint, render_template, request, url_for, redirect, flash
|
||||
from werkzeug.security import generate_password_hash, check_password_hash
|
||||
from flask_login import login_user, login_required, logout_user
|
||||
from ..models.user import User
|
||||
import base64
|
||||
import binascii
|
||||
import hashlib
|
||||
import hmac
|
||||
import re
|
||||
import secrets
|
||||
import struct
|
||||
from datetime import datetime, timedelta, timezone
|
||||
from urllib.parse import quote
|
||||
|
||||
from flask import Blueprint, flash, redirect, render_template, request, session, url_for
|
||||
from flask_login import current_user, login_required, login_user, logout_user
|
||||
from werkzeug.security import check_password_hash, generate_password_hash
|
||||
|
||||
from .. import db
|
||||
from ..models.login_attempt import LoginAttempt
|
||||
from ..models.user import User
|
||||
|
||||
login_bp = Blueprint("login", __name__)
|
||||
|
||||
MIN_PASSWORD_LENGTH = 8
|
||||
MAX_PASSWORD_LENGTH = 128
|
||||
MAX_LOGIN_FAILURES = 5
|
||||
LOGIN_LOCK_MINUTES = 15
|
||||
TWO_FACTOR_CODE_DIGITS = 6
|
||||
TWO_FACTOR_TIME_STEP_SECONDS = 30
|
||||
TWO_FACTOR_VALID_WINDOW = 1
|
||||
TWO_FACTOR_ISSUER = "8 Queens Solver"
|
||||
MAX_TWO_FACTOR_ATTEMPTS = 5
|
||||
USERNAME_PATTERN = re.compile(r"^[A-Za-z0-9_.-]{3,20}$")
|
||||
DUMMY_PASSWORD_HASH = generate_password_hash("dummy-password-for-timing-protection")
|
||||
|
||||
|
||||
def utcnow():
|
||||
return datetime.utcnow()
|
||||
|
||||
|
||||
def get_utc_timestamp(moment=None):
|
||||
if moment is None:
|
||||
return int(datetime.now(timezone.utc).timestamp())
|
||||
|
||||
if moment.tzinfo is None:
|
||||
moment = moment.replace(tzinfo=timezone.utc)
|
||||
|
||||
return int(moment.timestamp())
|
||||
|
||||
|
||||
def normalize_username(username):
|
||||
return (username or "").strip()
|
||||
|
||||
|
||||
def validate_username(username):
|
||||
if not USERNAME_PATTERN.fullmatch(username):
|
||||
return "Username must be 3-20 characters and only use letters, numbers, dots, dashes, or underscores."
|
||||
return None
|
||||
|
||||
|
||||
def validate_password(password):
|
||||
if len(password) < MIN_PASSWORD_LENGTH:
|
||||
return f"Password must be at least {MIN_PASSWORD_LENGTH} characters long."
|
||||
|
||||
if len(password) > MAX_PASSWORD_LENGTH:
|
||||
return f"Password must be at most {MAX_PASSWORD_LENGTH} characters long."
|
||||
|
||||
return None
|
||||
|
||||
|
||||
def get_request_ip():
|
||||
forwarded_for = request.headers.get("X-Forwarded-For", "")
|
||||
|
||||
if forwarded_for:
|
||||
return forwarded_for.split(",")[0].strip()[:45] or "unknown"
|
||||
|
||||
return (request.remote_addr or "unknown")[:45]
|
||||
|
||||
|
||||
def login_attempt_buckets(username):
|
||||
normalized_username = normalize_username(username).lower() or "__empty__"
|
||||
ip_address = get_request_ip()
|
||||
return [
|
||||
(ip_address, normalized_username),
|
||||
(ip_address, "__ip__"),
|
||||
]
|
||||
|
||||
|
||||
def get_or_create_attempt(ip_address, bucket_key):
|
||||
attempt = LoginAttempt.query.filter_by(ip_address=ip_address, username=bucket_key).first()
|
||||
|
||||
if attempt is None:
|
||||
attempt = LoginAttempt(ip_address=ip_address, username=bucket_key)
|
||||
db.session.add(attempt)
|
||||
|
||||
return attempt
|
||||
|
||||
|
||||
def clear_expired_lock(attempt, now):
|
||||
if attempt.locked_until and attempt.locked_until <= now:
|
||||
attempt.failed_attempts = 0
|
||||
attempt.locked_until = None
|
||||
|
||||
|
||||
def get_active_lock(username):
|
||||
now = utcnow()
|
||||
active_until = None
|
||||
|
||||
for ip_address, bucket_key in login_attempt_buckets(username):
|
||||
attempt = LoginAttempt.query.filter_by(ip_address=ip_address, username=bucket_key).first()
|
||||
|
||||
if not attempt:
|
||||
continue
|
||||
|
||||
clear_expired_lock(attempt, now)
|
||||
|
||||
if attempt.locked_until and (active_until is None or attempt.locked_until > active_until):
|
||||
active_until = attempt.locked_until
|
||||
|
||||
db.session.commit()
|
||||
return active_until
|
||||
|
||||
|
||||
def record_failed_login(username):
|
||||
now = utcnow()
|
||||
locked_until = None
|
||||
|
||||
for ip_address, bucket_key in login_attempt_buckets(username):
|
||||
attempt = get_or_create_attempt(ip_address, bucket_key)
|
||||
clear_expired_lock(attempt, now)
|
||||
attempt.failed_attempts = (attempt.failed_attempts or 0) + 1
|
||||
attempt.last_failed_at = now
|
||||
|
||||
if attempt.failed_attempts >= MAX_LOGIN_FAILURES:
|
||||
attempt.locked_until = now + timedelta(minutes=LOGIN_LOCK_MINUTES)
|
||||
locked_until = attempt.locked_until
|
||||
|
||||
db.session.commit()
|
||||
return locked_until
|
||||
|
||||
|
||||
def clear_login_attempts(username):
|
||||
for ip_address, bucket_key in login_attempt_buckets(username):
|
||||
attempt = LoginAttempt.query.filter_by(ip_address=ip_address, username=bucket_key).first()
|
||||
|
||||
if attempt:
|
||||
db.session.delete(attempt)
|
||||
|
||||
db.session.commit()
|
||||
|
||||
|
||||
def lookup_user_by_username(username):
|
||||
if not username:
|
||||
return None
|
||||
|
||||
return User.query.filter(db.func.lower(User.username) == username.lower()).first()
|
||||
|
||||
|
||||
def minutes_until(target_time):
|
||||
seconds = max(1, int((target_time - utcnow()).total_seconds()))
|
||||
return max(1, (seconds + 59) // 60)
|
||||
|
||||
|
||||
def normalize_two_factor_secret(secret):
|
||||
return (secret or "").strip().replace(" ", "").upper()
|
||||
|
||||
|
||||
def generate_two_factor_secret():
|
||||
return base64.b32encode(secrets.token_bytes(20)).decode("ascii").rstrip("=")
|
||||
|
||||
|
||||
def format_two_factor_secret(secret):
|
||||
normalized = normalize_two_factor_secret(secret)
|
||||
return " ".join(normalized[index:index + 4] for index in range(0, len(normalized), 4))
|
||||
|
||||
|
||||
def clear_pending_two_factor(user=None):
|
||||
session.pop("pending_2fa_user_id", None)
|
||||
session.pop("pending_2fa_attempts", None)
|
||||
|
||||
|
||||
def get_pending_two_factor_setup_secret(user):
|
||||
if session.get("pending_2fa_setup_user_id") != user.id:
|
||||
return None
|
||||
|
||||
secret = normalize_two_factor_secret(session.get("pending_2fa_setup_secret"))
|
||||
return secret or None
|
||||
|
||||
|
||||
def clear_pending_two_factor_setup():
|
||||
session.pop("pending_2fa_setup_user_id", None)
|
||||
session.pop("pending_2fa_setup_secret", None)
|
||||
|
||||
|
||||
def build_totp_uri(user, secret):
|
||||
normalized_secret = normalize_two_factor_secret(secret)
|
||||
label = quote(f"{TWO_FACTOR_ISSUER}:{user.username}")
|
||||
issuer = quote(TWO_FACTOR_ISSUER)
|
||||
return (
|
||||
f"otpauth://totp/{label}"
|
||||
f"?secret={normalized_secret}&issuer={issuer}"
|
||||
f"&algorithm=SHA1&digits={TWO_FACTOR_CODE_DIGITS}&period={TWO_FACTOR_TIME_STEP_SECONDS}"
|
||||
)
|
||||
|
||||
|
||||
def decode_two_factor_secret(secret):
|
||||
normalized_secret = normalize_two_factor_secret(secret)
|
||||
padded_secret = normalized_secret + ("=" * (-len(normalized_secret) % 8))
|
||||
return base64.b32decode(padded_secret, casefold=True)
|
||||
|
||||
|
||||
def generate_totp_code(secret, for_time=None):
|
||||
timestamp = get_utc_timestamp(for_time)
|
||||
counter = timestamp // TWO_FACTOR_TIME_STEP_SECONDS
|
||||
key = decode_two_factor_secret(secret)
|
||||
message = struct.pack(">Q", counter)
|
||||
digest = hmac.new(key, message, hashlib.sha1).digest()
|
||||
offset = digest[-1] & 0x0F
|
||||
truncated_hash = struct.unpack(">I", digest[offset:offset + 4])[0] & 0x7FFFFFFF
|
||||
code = truncated_hash % (10 ** TWO_FACTOR_CODE_DIGITS)
|
||||
return f"{code:0{TWO_FACTOR_CODE_DIGITS}d}"
|
||||
|
||||
|
||||
def verify_totp_code(secret, code, at_time=None):
|
||||
normalized_code = (code or "").strip()
|
||||
|
||||
if not normalized_code.isdigit() or len(normalized_code) != TWO_FACTOR_CODE_DIGITS:
|
||||
return False
|
||||
|
||||
current_time = at_time or utcnow()
|
||||
|
||||
try:
|
||||
for window in range(-TWO_FACTOR_VALID_WINDOW, TWO_FACTOR_VALID_WINDOW + 1):
|
||||
window_time = current_time + timedelta(seconds=window * TWO_FACTOR_TIME_STEP_SECONDS)
|
||||
|
||||
if secrets.compare_digest(generate_totp_code(secret, window_time), normalized_code):
|
||||
return True
|
||||
except (TypeError, ValueError, binascii.Error):
|
||||
return False
|
||||
|
||||
return False
|
||||
|
||||
|
||||
def get_pending_two_factor_user():
|
||||
user_id = session.get("pending_2fa_user_id")
|
||||
|
||||
if not user_id:
|
||||
return None
|
||||
|
||||
return db.session.get(User, user_id)
|
||||
|
||||
|
||||
def render_login_settings(error=None):
|
||||
pending_secret = get_pending_two_factor_setup_secret(current_user)
|
||||
formatted_secret = format_two_factor_secret(pending_secret) if pending_secret else None
|
||||
provisioning_uri = build_totp_uri(current_user, pending_secret) if pending_secret else None
|
||||
|
||||
return render_template(
|
||||
"login_settings.html",
|
||||
error=error,
|
||||
pending_two_factor_secret=formatted_secret,
|
||||
pending_two_factor_uri=provisioning_uri,
|
||||
)
|
||||
|
||||
|
||||
@login_bp.route("/register", methods=["GET", "POST"])
|
||||
def register():
|
||||
if current_user.is_authenticated:
|
||||
return redirect(url_for("main.dashboard"))
|
||||
|
||||
if request.method == "POST":
|
||||
username = request.form.get("username")
|
||||
password = request.form.get("password")
|
||||
username = normalize_username(request.form.get("username"))
|
||||
password = request.form.get("password") or ""
|
||||
|
||||
if User.query.filter_by(username=username).first():
|
||||
return render_template("sign_up.html", error="Username already taken!")
|
||||
username_error = validate_username(username)
|
||||
password_error = validate_password(password)
|
||||
|
||||
hashed_password = generate_password_hash(password)
|
||||
if username_error:
|
||||
return render_template("sign_up.html", error=username_error, username=username)
|
||||
|
||||
new_user = User(
|
||||
username=username,
|
||||
password=hashed_password
|
||||
)
|
||||
if password_error:
|
||||
return render_template("sign_up.html", error=password_error, username=username)
|
||||
|
||||
if lookup_user_by_username(username):
|
||||
return render_template("sign_up.html", error="Username already taken!", username=username)
|
||||
|
||||
new_user = User(username=username, password=generate_password_hash(password))
|
||||
db.session.add(new_user)
|
||||
db.session.commit()
|
||||
|
||||
flash("Account created successfully. You can log in now.", "success")
|
||||
return redirect(url_for("login.login"))
|
||||
|
||||
return render_template("sign_up.html")
|
||||
@@ -32,23 +293,201 @@ def register():
|
||||
|
||||
@login_bp.route("/login", methods=["GET", "POST"])
|
||||
def login():
|
||||
if current_user.is_authenticated:
|
||||
return redirect(url_for("main.dashboard"))
|
||||
|
||||
if request.method == "POST":
|
||||
username = request.form.get("username")
|
||||
password = request.form.get("password")
|
||||
username = normalize_username(request.form.get("username"))
|
||||
password = request.form.get("password") or ""
|
||||
|
||||
user = User.query.filter_by(username=username).first()
|
||||
if not username or not password:
|
||||
return render_template("login.html", error="Username and password are required.", username=username)
|
||||
|
||||
if user and check_password_hash(user.password, password):
|
||||
login_user(user)
|
||||
return redirect(url_for("main.dashboard"))
|
||||
locked_until = get_active_lock(username)
|
||||
|
||||
return render_template("login.html", error="Invalid username or password")
|
||||
if locked_until and locked_until > utcnow():
|
||||
return render_template(
|
||||
"login.html",
|
||||
error=f"Too many failed login attempts. Please try again in about {minutes_until(locked_until)} minute(s).",
|
||||
username=username,
|
||||
)
|
||||
|
||||
user = lookup_user_by_username(username)
|
||||
password_hash = user.password if user else DUMMY_PASSWORD_HASH
|
||||
password_matches = check_password_hash(password_hash, password)
|
||||
|
||||
if not user or not password_matches:
|
||||
locked_until = record_failed_login(username)
|
||||
error_message = "Invalid username or password."
|
||||
|
||||
if locked_until:
|
||||
error_message = (
|
||||
f"Too many failed login attempts. Please try again in about {minutes_until(locked_until)} minute(s)."
|
||||
)
|
||||
|
||||
return render_template("login.html", error=error_message, username=username)
|
||||
|
||||
clear_login_attempts(username)
|
||||
|
||||
if user.two_factor_enabled:
|
||||
if not user.two_factor_secret:
|
||||
return render_template(
|
||||
"login.html",
|
||||
error="This account requires two-factor authentication, but no authenticator app is configured.",
|
||||
username=username,
|
||||
)
|
||||
|
||||
session["pending_2fa_user_id"] = user.id
|
||||
session["pending_2fa_attempts"] = 0
|
||||
flash("Enter the current 6-digit code from your authenticator app.", "info")
|
||||
return redirect(url_for("login.verify_two_factor"))
|
||||
|
||||
user.last_login = utcnow()
|
||||
db.session.commit()
|
||||
login_user(user)
|
||||
clear_pending_two_factor()
|
||||
return redirect(url_for("main.dashboard"))
|
||||
|
||||
return render_template("login.html")
|
||||
|
||||
@login_bp.route('/logout', methods=['POST'])
|
||||
|
||||
@login_bp.route("/login/verify", methods=["GET", "POST"])
|
||||
def verify_two_factor():
|
||||
if current_user.is_authenticated:
|
||||
return redirect(url_for("main.dashboard"))
|
||||
|
||||
user = get_pending_two_factor_user()
|
||||
|
||||
if user is None:
|
||||
flash("Your verification session expired. Please log in again.", "error")
|
||||
return redirect(url_for("login.login"))
|
||||
|
||||
if request.method == "POST":
|
||||
code = (request.form.get("code") or "").strip()
|
||||
|
||||
if not code.isdigit() or len(code) != TWO_FACTOR_CODE_DIGITS:
|
||||
return render_template(
|
||||
"two_factor_verify.html",
|
||||
error="Please enter the 6-digit verification code.",
|
||||
)
|
||||
|
||||
attempts = int(session.get("pending_2fa_attempts", 0))
|
||||
|
||||
if attempts >= MAX_TWO_FACTOR_ATTEMPTS:
|
||||
clear_pending_two_factor(user)
|
||||
db.session.commit()
|
||||
flash("Too many invalid 2FA attempts. Please log in again.", "error")
|
||||
return redirect(url_for("login.login"))
|
||||
|
||||
if not user.two_factor_secret:
|
||||
clear_pending_two_factor()
|
||||
flash("Authenticator app 2FA is not configured for this account.", "error")
|
||||
return redirect(url_for("login.login"))
|
||||
|
||||
if not verify_totp_code(user.two_factor_secret, code):
|
||||
attempts += 1
|
||||
session["pending_2fa_attempts"] = attempts
|
||||
|
||||
if attempts >= MAX_TWO_FACTOR_ATTEMPTS:
|
||||
clear_pending_two_factor(user)
|
||||
db.session.commit()
|
||||
flash("Too many invalid 2FA attempts. Please log in again.", "error")
|
||||
return redirect(url_for("login.login"))
|
||||
|
||||
remaining_attempts = MAX_TWO_FACTOR_ATTEMPTS - attempts
|
||||
return render_template(
|
||||
"two_factor_verify.html",
|
||||
error=f"Invalid authenticator code. You have {remaining_attempts} attempt(s) left.",
|
||||
)
|
||||
|
||||
clear_pending_two_factor(user)
|
||||
user.last_login = utcnow()
|
||||
db.session.commit()
|
||||
login_user(user)
|
||||
flash("Two-factor authentication successful.", "success")
|
||||
return redirect(url_for("main.dashboard"))
|
||||
|
||||
return render_template("two_factor_verify.html")
|
||||
|
||||
|
||||
@login_bp.route("/login/settings", methods=["GET", "POST"])
|
||||
@login_required
|
||||
def login_settings():
|
||||
if request.method == "POST":
|
||||
action = request.form.get("action")
|
||||
|
||||
if action == "start_two_factor_setup":
|
||||
if current_user.two_factor_enabled:
|
||||
return render_login_settings(error="Authenticator app 2FA is already enabled.")
|
||||
|
||||
secret = generate_two_factor_secret()
|
||||
session["pending_2fa_setup_user_id"] = current_user.id
|
||||
session["pending_2fa_setup_secret"] = secret
|
||||
flash("Add the secret to your authenticator app, then confirm it with the current 6-digit code.", "info")
|
||||
return redirect(url_for("login.login_settings"))
|
||||
|
||||
if action == "confirm_two_factor_setup":
|
||||
pending_secret = get_pending_two_factor_setup_secret(current_user)
|
||||
|
||||
if not pending_secret:
|
||||
return render_login_settings(error="Start the authenticator setup first.")
|
||||
|
||||
code = (request.form.get("code") or "").strip()
|
||||
|
||||
if not verify_totp_code(pending_secret, code):
|
||||
return render_login_settings(error="Invalid authenticator code. Please try the current code again.")
|
||||
|
||||
current_user.two_factor_secret = pending_secret
|
||||
current_user.two_factor_enabled = True
|
||||
clear_pending_two_factor_setup()
|
||||
db.session.commit()
|
||||
flash("Authenticator app 2FA enabled.", "success")
|
||||
return redirect(url_for("login.login_settings"))
|
||||
|
||||
if action == "cancel_two_factor_setup":
|
||||
clear_pending_two_factor_setup()
|
||||
flash("Authenticator app setup cancelled.", "info")
|
||||
return redirect(url_for("login.login_settings"))
|
||||
|
||||
if action == "disable_two_factor":
|
||||
current_user.two_factor_enabled = False
|
||||
current_user.two_factor_secret = None
|
||||
clear_pending_two_factor_setup()
|
||||
db.session.commit()
|
||||
flash("Authenticator app 2FA disabled.", "success")
|
||||
return redirect(url_for("login.login_settings"))
|
||||
|
||||
if action == "password":
|
||||
current_password = request.form.get("current_password") or ""
|
||||
new_password = request.form.get("new_password") or ""
|
||||
confirm_password = request.form.get("confirm_password") or ""
|
||||
|
||||
if not check_password_hash(current_user.password, current_password):
|
||||
return render_login_settings(error="Your current password is incorrect.")
|
||||
|
||||
password_error = validate_password(new_password)
|
||||
|
||||
if password_error:
|
||||
return render_login_settings(error=password_error)
|
||||
|
||||
if new_password != confirm_password:
|
||||
return render_login_settings(error="The new passwords do not match.")
|
||||
|
||||
current_user.password = generate_password_hash(new_password)
|
||||
db.session.commit()
|
||||
flash("Password updated successfully.", "success")
|
||||
return redirect(url_for("login.login_settings"))
|
||||
|
||||
return render_login_settings(error="Unknown settings action.")
|
||||
|
||||
return render_login_settings()
|
||||
|
||||
|
||||
@login_bp.route("/logout", methods=["POST"])
|
||||
@login_required
|
||||
def logout():
|
||||
clear_pending_two_factor()
|
||||
clear_pending_two_factor_setup()
|
||||
logout_user()
|
||||
flash('You have been logged out', 'info')
|
||||
return redirect(url_for('login.login'))
|
||||
flash("You have been logged out.", "info")
|
||||
return redirect(url_for("login.login"))
|
||||
|
||||
Reference in New Issue
Block a user