#28285: Updating Password Hasher Invalidates Users First Login After Upgrade
---------------------------------+--------------------------------------
Reporter: Simon Blanchard | Owner: nobody
Type: Bug | Status: new
Component: contrib.auth | Version: 1.11
Severity: Normal | Resolution:
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+--------------------------------------
Comment (by Simon Blanchard):
Replying to [comment:3 Tim Graham]:
> I'm not following your scenario. Could you please give your steps to
reproduce?
{{{
def get_user(request):
"""
Returns the user model instance associated with the given request
session.
If no user is retrieved an instance of `AnonymousUser` is returned.
"""
from .models import AnonymousUser
user = None
try:
user_id = _get_user_session_key(request)
backend_path = request.session[BACKEND_SESSION_KEY]
except KeyError:
pass
else:
if backend_path in settings.AUTHENTICATION_BACKENDS:
backend = load_backend(backend_path)
user = backend.get_user(user_id)
# Verify the session
if hasattr(user, 'get_session_auth_hash'):
session_hash = request.session.get(HASH_SESSION_KEY)
session_hash_verified = session_hash and
constant_time_compare(
session_hash,
user.get_session_auth_hash()
)
if not session_hash_verified:
request.session.flush()
user = None
return user or AnonymousUser()
}}}
get_user() verifies the user's session hash is the same as the one in the
session. If the users session hash (calculated from the password hash) is
different from that stored in the session, the session is flushed.
So the scenario is:
1. Upgrade Django
2. User logs in
3. Session hash is set from original password hash before the upgrade
4. Django updates password hash but does not update the session hash
5. On next request, get_user() notices the session hash and password hash
are different
6. Session is flushed
7. User is logged out
At least that's what I think is happening. But looking at the code I'm not
so sure. authenticate() should be callled before login(), authenticate()
updates the hash, then login() should be setting the session key with the
new hash, oh I may be passing an old user object - with former password
hash to login. Sorry my mistake! Thanks!
--
Ticket URL: <https://code.djangoproject.com/ticket/28285#comment:4>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/064.c207bdf653387ffdda5809b48474d214%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
