Re: [Django] #32130: 3.0 -> 3.1 password token incompatibility.

[Django]

#32130: 3.0 -> 3.1 password token incompatibility.
+--
 Reporter:  Gordon Wrigley  |Owner:  nobody
 Type:  Uncategorized   |   Status:  new
Component:  Uncategorized   |  Version:  3.1
 Severity:  Normal  |   Resolution:
 Keywords:  | Triage Stage:  Unreviewed
Has patch:  0   |  Needs documentation:  0
  Needs tests:  0   |  Patch needs improvement:  0
Easy pickings:  0   |UI/UX:  0
+--

Comment (by Adam (Chainz) Johnson):

 It’s seconds/days since January 2001, so I don’t think it’s clunky... I
 doubt anyone is running an app with the clock set between 2001 and 2002
 for example.

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/065.af3fbf9fe2bc0868578ec0a8a302e422%40djangoproject.com.

Re: [Django] #32130: 3.0 -> 3.1 password token incompatibility.

[Django]

#32130: 3.0 -> 3.1 password token incompatibility.
+--
 Reporter:  Gordon Wrigley  |Owner:  nobody
 Type:  Uncategorized   |   Status:  new
Component:  Uncategorized   |  Version:  3.1
 Severity:  Normal  |   Resolution:
 Keywords:  | Triage Stage:  Unreviewed
Has patch:  0   |  Needs documentation:  0
  Needs tests:  0   |  Patch needs improvement:  0
Easy pickings:  0   |UI/UX:  0
+--

Comment (by Mariusz Felisiak):

 Great catch, we missed this. However, I'm not sure what we can do, any
 heuristic will be clunky, IMO. 1 second, 1 day, 300k seconds, or 300k days
 are all valid.

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/065.5a7aa118a51146d0d2c8aeddad197280%40djangoproject.com.

Re: [Django] #32130: 3.0 -> 3.1 password token incompatibility.

[Django]

#32130: 3.0 -> 3.1 password token incompatibility.
+--
 Reporter:  Gordon Wrigley  |Owner:  nobody
 Type:  Uncategorized   |   Status:  new
Component:  Uncategorized   |  Version:  3.1
 Severity:  Normal  |   Resolution:
 Keywords:  | Triage Stage:  Unreviewed
Has patch:  0   |  Needs documentation:  0
  Needs tests:  0   |  Patch needs improvement:  0
Easy pickings:  0   |UI/UX:  0
+--

Comment (by Gordon Wrigley):

 We've been discussing using patchy to do something to that effect.

 With free code access you can easily tell because the prefix is 3
 characters in the old scheme and 6 in the other so you could switch off
 that.

 If you were to switch off value anything in the 10k (~27*365) -
 600m(~19*365*60*60) range should be a safe cutoff.

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/065.bb3b6c820984bd5bf788f41a397d0ba2%40djangoproject.com.

Re: [Django] #32130: 3.0 -> 3.1 password token incompatibility.

[Django]

#32130: 3.0 -> 3.1 password token incompatibility.
+--
 Reporter:  Gordon Wrigley  |Owner:  nobody
 Type:  Uncategorized   |   Status:  new
Component:  Uncategorized   |  Version:  3.1
 Severity:  Normal  |   Resolution:
 Keywords:  | Triage Stage:  Unreviewed
Has patch:  0   |  Needs documentation:  0
  Needs tests:  0   |  Patch needs improvement:  0
Easy pickings:  0   |UI/UX:  0
+--
Changes (by Adam (Chainz) Johnson):

 * cc: Adam (Chainz) Johnson (added)


-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/065.5688ed7fdd450f43927ee51e5e46747f%40djangoproject.com.

Re: [Django] #32130: 3.0 -> 3.1 password token incompatibility.

[Django]

#32130: 3.0 -> 3.1 password token incompatibility.
+--
 Reporter:  Gordon Wrigley  |Owner:  nobody
 Type:  Uncategorized   |   Status:  new
Component:  Uncategorized   |  Version:  3.1
 Severity:  Normal  |   Resolution:
 Keywords:  | Triage Stage:  Unreviewed
Has patch:  0   |  Needs documentation:  0
  Needs tests:  0   |  Patch needs improvement:  0
Easy pickings:  0   |UI/UX:  0
+--

Comment (by Adam (Chainz) Johnson):

 This seems like an oversight. Would it make sense to reinterpret tokens
 with a timeout less than some small-in-seconds but large-in-days cutoff,
 such as 3600 * 365, as days instead of seconds?

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/065.fbda4508d00380a0adef1ad4f60b4462%40djangoproject.com.

[Django] #32130: 3.0 -> 3.1 password token incompatibility.

[Django]

#32130: 3.0 -> 3.1 password token incompatibility.
--+
   Reporter:  Gordon Wrigley  |  Owner:  nobody
   Type:  Uncategorized   | Status:  new
  Component:  Uncategorized   |Version:  3.1
   Severity:  Normal  |   Keywords:
   Triage Stage:  Unreviewed  |  Has patch:  0
Needs documentation:  0   |Needs tests:  0
Patch needs improvement:  0   |  Easy pickings:  0
  UI/UX:  0   |
--+
 As noted here https://docs.djangoproject.com/en/3.1/releases/3.1/#django-
 contrib-auth the hashing for password reset tokens has changed between 3.0
 and 3.1 and work has been done to ensure existing tokens will still work
 (at least until 4.0).

 However the encoding of the token creation time has also changed.
 Specifically from days since 1/1/01 to seconds since 1/1/01. And it
 appears no work has been done to support tokens with the older values. So
 a token generated on Oct 1, 2020 will come through as 7213 days which will
 then get interpreted as 7213 seconds, aka 2am Jan 1, 2001.

 So while exiting tokens in the wild will pass crypto validation they will
 all show as expired if your PASSWORD_RESET_TIMEOUT is less than ~20 years.

 The code base I'm working on uses these tokens (perhaps unwisely) in some
 email links that are expected to have a 3 month lifetime and an upgrade
 from 3.0 to 3.1 looks likely to render all the tokens in the wild expired
 which is suboptimal.

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/050.8e71621c8b51696cd2a97ef36ae97bf5%40djangoproject.com.