yetangitu/funkwhale
1
0
Fork 0
mirror of https://code.eliotberriot.com/funkwhale/funkwhale.git synced 2025-10-04 00:39:16 +02:00
Code Issues Releases Wiki Activity

Increase the security of JWT token generation by using DJANGO_SECRET_KEY as well as user-specific salt for the signature

Browse source
This commit is contained in:
Eliot Berriot 2019-07-13 15:51:34 +02:00
parent 426f6f0d45
commit d39cfab283
No known key found for this signature in database
GPG key ID: DD6965E2476E5C27
4 changed files with 29 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

9
api/config/settings/common.py
View file

@ -564,12 +564,19 @@ CELERY_BEAT_SCHEDULE = {
NODEINFO_REFRESH_DELAY = env.int("NODEINFO_REFRESH_DELAY", default=3600 * 24)
def get_user_secret_key(user):
from django.conf import settings
return settings.SECRET_KEY + str(user.secret_key)
JWT_AUTH = {
"JWT_ALLOW_REFRESH": True,
"JWT_EXPIRATION_DELTA": datetime.timedelta(days=7),
"JWT_REFRESH_EXPIRATION_DELTA": datetime.timedelta(days=30),
"JWT_AUTH_HEADER_PREFIX": "JWT",
"JWT_GET_USER_SECRET_KEY": lambda user: user.secret_key,
"JWT_GET_USER_SECRET_KEY": get_user_secret_key,
}
OLD_PASSWORD_FIELD_ENABLED = True
ACCOUNT_ADAPTER = "funkwhale_api.users.adapters.FunkwhaleAccountAdapter"