Flask: How To Prevent Replay Attacks

送分小仙女□ 提交于 2021-02-08 07:57:18

问题


I'm trying to implement a logic in my Flask application to prevent reply attacks. Regarding to the question asked here, My idea is to set the current session lifetime when user logs out from the system. In general, it is suggested to set the session lifetime this way:

@app.before_request
def before_request():
    session.permanent = True
    app.permanent_session_lifetime = timedelta(minutes=10)

However, I want to set my current session life time when user logs out from the system. Something like the following code:

@app.after_request
def app_after_request(response):
    response.headers["X-Frame-Options"] = "SAMEORIGIN"
    if "__logged_out__" in session and session["__logged_out__"] is True:
        session.clear()
        response.set_cookie(app.session_cookie_name, '', expires=0)
    return response

I also checked this question, but the problem is that I'm dealing with some confidential data and I have to ensure that session is cleared after user logged out from the system. Is there any way to set one session lifetime after creation manually? or is there any easy way to handle this situation with flask-login?


回答1:


I found the solution. I should simply use Flask-KVSession package to store session data in database (or any other data storage) instead of server memory. As the package website introduced:

Flask-KVSession is an MIT-licensed server-side session replacement for Flask‘s signed client-based session management. Instead of storing data on the client, only a securely generated ID is stored on the client, while the actual session data resides on the server.

You also need to create a key-value paired table in your database (it has named sessions by default, but you can change the name and schema as well) and point it to your flask app object. More information can be found here.



来源:https://stackoverflow.com/questions/30848665/flask-how-to-prevent-replay-attacks

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!