search

mkhorasani / Streamlit-Authenticator

A secure authentication module to validate user credentials in a Streamlit application.
Apache License 2.0
1.38k stars 229 forks source link

Unsafe characters allowed in username creation #53

Closed velicanu closed 1 year ago

velicanu commented 1 year ago

Currently there is no restriction on characters in a username, which can result in security issues if the value of the username is not handled properly post authentication. Example:

Screen Shot 2023-03-15 at 8 43 48 AM

Would you be open to allowing only alphanumeric + _ , or alternatively to let the auth module take a username validator as an optional parameter to decide the allowed character set?

mkhorasani commented 1 year ago

Hi @velicanu, yes actually there is a pull request pertaining to this request, and I will merge it very soon.