Altcha validation fails due to signature mismatch when running in wsgi deployment with multiple workers.
|
ALTCHA_HMAC_KEY = getattr(settings, "ALTCHA_HMAC_KEY", secrets.token_hex(32)) |
Fallback key generation does not work reliably in wsgi deployments with multiple workers, since each worker loads
django_altcha independently, and each one ends up generating a different
ALTCHA_HMAC_KEY key. And when challenge generation and validation happen in different workers, Altcha validation fails due to signature mismatch.
Possible fix would be to make ALTCHA_HMAC_KEY mandatory.
Altcha validation fails due to signature mismatch when running in wsgi deployment with multiple workers.
django-altcha/django_altcha/__init__.py
Line 30 in cd40299
Fallback key generation does not work reliably in wsgi deployments with multiple workers, since each worker loads
django_altchaindependently, and each one ends up generating a differentALTCHA_HMAC_KEYkey. And when challenge generation and validation happen in different workers, Altcha validation fails due to signature mismatch.Possible fix would be to make
ALTCHA_HMAC_KEYmandatory.