Flask-security: Configuration should be 'secure by default'

[adamlwgriffiths]

All security libs should be secure by default.
Flask-security is not.
This prevents flask-security from being run 'off the shelf'.

SECURITY_PASSWORD_HASH is plaintext by default. This should default to perhaps bcrypt.
SECURITY_PASSWORD_SALT is None by default. This should be set to a valid default. Although that would mean a common salt between any vanilla installs, any salt is better than None.

[mattupstate]

I understand your concern, but I'm not sure I agree with this. This would require me to make a decision on the encryption algorithm that should be the default and I'm not prepared to do that. The good news is that passlib supports updating hashes after they've been decided so its pretty trivial to update them after the fact.

[corydolphin]

A default has already been chosen. And that default is the least secure of plausible options. I think it should be changed.

@adamlwgriffiths I too am surprised by this default behavior and I believe that it should be changed.

@mattupstate I believe that currently a decision is made on the encryption algorithm default, and that is to use the least secure one possible. What if the default was set to 'bcrypt', and a warning logged if the SECURITY_PASSWORD_SALT key is not set in app.config?

I believe this would both improve the out-of-box security of Flask-Security (and the flask ecosystem as a whole!), and ensure that everyone makes a decision on the encryption algorithm.

[chrsbats]

I agree. If there is a desire to avoid choosing a default encryption algorithm, it would be better to throw an exception explaining that the algorithm must be set first rather than setting it to plaintext, which I would class as not secure. I'm not so sure that it should even be an option.

Also when reading the documentation is not obvious that the default setting is plaintext until you read the finer details on the configuration page. There's nothing around to suggest that fact that the lib is not setup in a production ready mode.

[adamlwgriffiths]

Good to see that flask-security still defaults to 'plaintext' password hashing.
Oh what an age we live in.

[PierreRochard]

@adamlwgriffiths Your hearts in the right place and I agree with you, but necro-posting like this is not constructive. I highly encourage you to submit a pull request that takes into account the feedback provided in this thread 1.5 years ago.