mirror of
https://github.com/thecyberlearn/quantum-ai-v2.git
synced 2026-08-18 20:32:58 +00:00
916d37fd64
CRITICAL SECURITY FIXES: • Fix information disclosure in error messages - prevent system info leakage • Implement rate limiting - 5 login attempts/min, 3 registration/min, 3 password reset/5min • Add backend password strength validation - enforce strong passwords with complexity rules • Implement email verification - require email confirmation for new accounts SECURITY ENHANCEMENTS: • Sanitize all error messages to prevent information leakage • Add comprehensive rate limiting with django-ratelimit • Enforce password requirements: 8+ chars, upper/lower case, numbers, special chars • Block common weak passwords (password, 123456, etc.) • Email verification with 24-hour secure UUID tokens • Prevent login without email verification • Security logging for monitoring and audit trails TECHNICAL IMPROVEMENTS: • Add EmailVerificationToken model with auto-expiration • Add password strength validation function with detailed rules • Add send_verification_email() utility function • Add resend verification functionality with rate limiting • Update existing users to verified status for continuity • Add comprehensive URL routing for verification flows BUSINESS BENEFITS: • Enhanced platform security and user trust • Reduced fake accounts and email abuse • Better compliance with security standards • Improved user account protection Security rating improved significantly ⬆️ All critical authentication vulnerabilities resolved ✅ 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
54 lines
1.6 KiB
Python
54 lines
1.6 KiB
Python
# Generated by Django 5.2.4 on 2025-07-25 18:24
|
|
|
|
import django.db.models.deletion
|
|
import uuid
|
|
from django.conf import settings
|
|
from django.db import migrations, models
|
|
|
|
|
|
class Migration(migrations.Migration):
|
|
|
|
dependencies = [
|
|
("authentication", "0003_passwordresettoken"),
|
|
]
|
|
|
|
operations = [
|
|
migrations.AddField(
|
|
model_name="user",
|
|
name="email_verified",
|
|
field=models.BooleanField(default=False),
|
|
),
|
|
migrations.CreateModel(
|
|
name="EmailVerificationToken",
|
|
fields=[
|
|
(
|
|
"id",
|
|
models.BigAutoField(
|
|
auto_created=True,
|
|
primary_key=True,
|
|
serialize=False,
|
|
verbose_name="ID",
|
|
),
|
|
),
|
|
(
|
|
"token",
|
|
models.UUIDField(default=uuid.uuid4, editable=False, unique=True),
|
|
),
|
|
("created_at", models.DateTimeField(auto_now_add=True)),
|
|
("expires_at", models.DateTimeField()),
|
|
("is_used", models.BooleanField(default=False)),
|
|
(
|
|
"user",
|
|
models.ForeignKey(
|
|
on_delete=django.db.models.deletion.CASCADE,
|
|
related_name="email_verification_tokens",
|
|
to=settings.AUTH_USER_MODEL,
|
|
),
|
|
),
|
|
],
|
|
options={
|
|
"ordering": ["-created_at"],
|
|
},
|
|
),
|
|
]
|