search

quinone / password-manager

Password management application developed as a group project for college.
0 stars 0 forks source link

Security breach with new settings and password_generator access without login #45

Closed Pitoche closed 3 weeks ago

Pitoche commented 1 month ago

I have created separately "PasGenerator.py" and "settings.py" , I am not sure but think is best practice. However, I have noticed that I can access these endpoints directly

http://127.0.0.1:5000/password_generator and http://127.0.0.1:5000/settings

even without login. which is a security breach. well, not really as they cannot access any of the user data but security never the less I have tried everything and am still not sure
I honestly thought that the decorator @login_required was all needed and that Falsk would do the rest but I might be missing something important and.or obvious

Pitoche commented 3 weeks ago

@quinone @Rachie94 I saw these working breafly (not allowing to be open without first being logged in), but now it is broken again