mirror of
https://github.com/thecyberlearn/quantum-ai-v2.git
synced 2026-08-18 19:52:59 +00:00
916d37fd64
CRITICAL SECURITY FIXES: • Fix information disclosure in error messages - prevent system info leakage • Implement rate limiting - 5 login attempts/min, 3 registration/min, 3 password reset/5min • Add backend password strength validation - enforce strong passwords with complexity rules • Implement email verification - require email confirmation for new accounts SECURITY ENHANCEMENTS: • Sanitize all error messages to prevent information leakage • Add comprehensive rate limiting with django-ratelimit • Enforce password requirements: 8+ chars, upper/lower case, numbers, special chars • Block common weak passwords (password, 123456, etc.) • Email verification with 24-hour secure UUID tokens • Prevent login without email verification • Security logging for monitoring and audit trails TECHNICAL IMPROVEMENTS: • Add EmailVerificationToken model with auto-expiration • Add password strength validation function with detailed rules • Add send_verification_email() utility function • Add resend verification functionality with rate limiting • Update existing users to verified status for continuity • Add comprehensive URL routing for verification flows BUSINESS BENEFITS: • Enhanced platform security and user trust • Reduced fake accounts and email abuse • Better compliance with security standards • Improved user account protection Security rating improved significantly ⬆️ All critical authentication vulnerabilities resolved ✅ 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
15 lines
676 B
Python
15 lines
676 B
Python
from django.urls import path
|
|
from . import views
|
|
|
|
app_name = 'authentication'
|
|
|
|
urlpatterns = [
|
|
path('login/', views.login_view, name='login'),
|
|
path('register/', views.register_view, name='register'),
|
|
path('logout/', views.logout_view, name='logout'),
|
|
path('profile/', views.profile_view, name='profile'),
|
|
path('forgot-password/', views.forgot_password_view, name='forgot_password'),
|
|
path('reset-password/<uuid:token>/', views.reset_password_view, name='reset_password'),
|
|
path('verify-email/<uuid:token>/', views.verify_email_view, name='verify_email'),
|
|
path('resend-verification/', views.resend_verification_view, name='resend_verification'),
|
|
] |