Mercurial > p > roundup > code
view roundup/anypy/random_.py @ 7809:be6cb2e0d471
feat: add support for rotating jwt keys
This allows jwt_secret to have multiple ',' separated secrets. The
first/leftmost should be used to sign new JWTs. All of them are used
(starting from left/newest) to try to verify a JWT.
If the first secret is < 32 chars in length JWTs are disabled. If any
of the other secrets are < 32 chars, the configuration code causes the
software to exit. This prevents insecure (too short) secrets from
being used.
Updated doc examples and tests.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Thu, 14 Mar 2024 19:04:19 -0400 |
| parents | f002747b6773 |
| children |
line wrap: on
line source
# ruff: noqa: ARG001 try: from secrets import choice, randbelow, token_bytes def seed(v=None): pass is_weak = False except ImportError: import os as _os import random as _random # prefer to use SystemRandom if it is available if hasattr(_random, 'SystemRandom'): def seed(v=None): pass _r = _random.SystemRandom() is_weak = False else: # don't completely throw away the existing state, but add some # more random state to the existing state def seed(v=None): # ruff: noqa: PLC0415 import os import time _r.seed((_r.getstate(), v, hasattr(os, 'getpid') and os.getpid(), time.time())) # create our own instance so we don't mess with the global # random number generator _r = _random.Random() seed() is_weak = True choice = _r.choice def randbelow(i): return _r.randint(0, i - 1) if hasattr(_os, 'urandom'): def token_bytes(size): return _os.urandom(size) else: def token_bytes(size): _bchr = chr if str is bytes else lambda x: bytes((x,)) return b''.join([_bchr(_r.getrandbits(8)) for i in range(size)])
