Merge pull request #86 from James1345/develop

3.1.1 release

CHANGELOG.rst

@@ -1,3 +1,8 @@
+######
+3.1.1
+######
+- use hmac.compare_digest instead of == for comparing hashes for more security
+
 ######
 3.1.0
 ######

docs/changes.md

@@ -1,5 +1,8 @@
 #Changelog
 
+## 3.1.1
+- use hmac.compare_digest instead of == for comparing hashes for more security
+
 ## 3.1.0
 - drop Django 1.8 support as djangorestframework did so too in v.3.7.0
 - build rest-knox on Django 1.11 and 2.0

knox/auth.py

@@ -1,3 +1,5 @@
+from hmac import compare_digest
+
 from django.conf import settings
 from django.utils.translation import ugettext_lazy as _
 from django.utils import timezone
@@ -68,7 +70,7 @@ def authenticate_credentials(self, token):
                 digest = hash_token(token, auth_token.salt)
             except TypeError:
                 raise exceptions.AuthenticationFailed(msg)
-            if digest == auth_token.digest:
+            if compare_digest(digest, auth_token.digest):
                 return self.validate_user(auth_token)
         # Authentication with this token has failed
         raise exceptions.AuthenticationFailed(msg)

setup.py

@@ -16,7 +16,7 @@
     # Versions should comply with PEP440.  For a discussion on single-sourcing
     # the version across setup.py and the project code, see
     # https://packaging.python.org/en/latest/single_source_version.html
-    version='3.1.0',
+    version='3.1.1',
     description='Authentication for django rest framework',
     long_description=long_description,