🐛 (safe_str_cmp) Use hmac.compare_digest instead of safe_str_cmp

jslvtr · jslvtr · commit 9acc05372927 · 2022-04-06T17:16:13.000+01:00
In Werkzeug 2.1, `safe_str_cmp` has been removed (after being deprecated a while ago). The recommendation from the Werkzeug team is to use `hmac.compare_digest`.

In this repo we were using `safe_str_cmp` in sections 7 and 8, so that has now been replaced.
diff --git a/section7/video_code/security.py b/section7/video_code/security.py
@@ -1,10 +1,10 @@
-from werkzeug.security import safe_str_cmp
+from hmac import compare_digest
 from models.user import UserModel
 
 
 def authenticate(username, password):
     user = UserModel.find_by_username(username)
-    if user and safe_str_cmp(user.password, password):
+    if user and compare_digest(user.password, password):
         return user
 
 
diff --git a/section8/video_code/security.py b/section8/video_code/security.py
@@ -1,10 +1,10 @@
-from werkzeug.security import safe_str_cmp
+from hmac import compare_digest
 from models.user import UserModel
 
 
 def authenticate(username, password):
     user = UserModel.find_by_username(username)
-    if user and safe_str_cmp(user.password, password):
+    if user and compare_digest(user.password, password):
         return user
 
 
