# Broken Authentication

import re
from password_strength import PasswordPolicy

policy = PasswordPolicy.from_names(
    length=12,              # Minimum 12 characters
    uppercase=1,            # At least 1 uppercase
    lowercase=1,            # At least 1 lowercase
    numbers=1,              # At least 1 number
    special=1,              # At least 1 special char
    nonletters=2,           # At least 2 non-letters
)

# Common password blacklist
COMMON_PASSWORDS = [
    '123456', 'password', 'qwerty', '12345678',
    '111111', '123456789', 'letmein', 'admin'
    # ... thousands more
]

def validate_password(password):
    # Check policy
    if not policy.test(password):
        return False, "Password doesn't meet complexity requirements"

    # Check against common passwords
    if password.lower() in COMMON_PASSWORDS:
        return False, "Password is too common"

    # Check against breached passwords
    if is_password_breached(password):
        return False, "Password found in known data breaches"

    return True, "Password is strong"

def is_password_breached(password):
    import hashlib
    import requests

    # Hash password (k-anonymity model)
    sha1 = hashlib.sha1(password.encode()).hexdigest().upper()
    prefix = sha1[:5]
    suffix = sha1[5:]

    # Query haveibeenpwned API
    url = f'https://api.pwnedpasswords.com/range/{prefix}'
    response = requests.get(url)

    # Check if hash suffix appears in response
    return suffix in response.text

import pyotp
import qrcode

def setup_2fa(user):
    # Generate secret key
    secret = pyotp.random_base32()

    # Store secret for user
    user.totp_secret = secret
    user.save()

    # Generate QR code for authenticator app
    totp_uri = pyotp.totp.TOTP(secret).provisioning_uri(
        name=user.email,
        issuer_name='YourApp'
    )

    qr = qrcode.make(totp_uri)
    return qr

def verify_2fa_code(user, code):
    totp = pyotp.TOTP(user.totp_secret)
    return totp.verify(code, valid_window=1)

@app.route('/login', methods=['POST'])
def login():
    user = authenticate(request.form['username'], request.form['password'])

    if not user:
        return "Invalid credentials", 401

    if user.has_2fa_enabled:
        # Require 2FA code
        session['pending_2fa_user_id'] = user.id
        return redirect('/2fa-verify')

    login_user(user)
    return redirect('/dashboard')

@app.route('/2fa-verify', methods=['POST'])
def verify_2fa():
    user_id = session.get('pending_2fa_user_id')
    user = User.query.get(user_id)

    code = request.form['code']

    if verify_2fa_code(user, code):
        login_user(user)
        session.pop('pending_2fa_user_id')
        return redirect('/dashboard')

    return "Invalid 2FA code", 401

from flask_limiter import Limiter
from flask_limiter.util import get_remote_address
from datetime import datetime, timedelta

limiter = Limiter(
    app,
    key_func=get_remote_address,
    default_limits=["200 per day", "50 per hour"]
)

# Track failed login attempts
class LoginAttempt:
    def __init__(self):
        self.attempts = {}  # {username: [(timestamp, ip), ...]}

    def record_failure(self, username, ip):
        if username not in self.attempts:
            self.attempts[username] = []

        # Clean old attempts (>1 hour)
        cutoff = datetime.now() - timedelta(hours=1)
        self.attempts[username] = [
            (ts, ip) for ts, ip in self.attempts[username]
            if ts > cutoff
        ]

        self.attempts[username].append((datetime.now(), ip))

    def is_locked(self, username):
        if username not in self.attempts:
            return False

        # Lock after 5 failed attempts in 1 hour
        return len(self.attempts[username]) >= 5

login_attempts = LoginAttempt()

@app.route('/login', methods=['POST'])
@limiter.limit("5 per minute")  # Rate limit per IP
def login():
    username = request.form['username']
    password = request.form['password']

    # Check if account is locked
    if login_attempts.is_locked(username):
        unlock_time = login_attempts.get_lockout_time(username)
        remaining = (unlock_time - datetime.now()).seconds // 60
        return f"Account locked. Try again in {remaining} minutes.", 429

    # Authenticate
    user = User.query.filter_by(username=username).first()

    if not user or not user.check_password(password):
        # Record failed attempt
        login_attempts.record_failure(username, request.remote_addr)

        # Get remaining attempts
        remaining_attempts = 5 - len(login_attempts.attempts.get(username, []))

        return f"Invalid credentials. {remaining_attempts} attempts remaining.", 401

    # Success - clear failed attempts
    if username in login_attempts.attempts:
        del login_attempts.attempts[username]

    login_user(user)
    return redirect('/dashboard')

from flask import Flask, session
import secrets
import redis
from datetime import timedelta

app = Flask(__name__)

# Use cryptographically secure secret key
app.secret_key = secrets.token_hex(32)

# Server-side session storage
app.config['SESSION_TYPE'] = 'redis'
app.config['SESSION_REDIS'] = redis.from_url('redis://localhost:6379')
app.config['SESSION_PERMANENT'] = True
app.config['PERMANENT_SESSION_LIFETIME'] = timedelta(hours=1)

# Cookie security settings
app.config['SESSION_COOKIE_SECURE'] = True      # HTTPS only
app.config['SESSION_COOKIE_HTTPONLY'] = True    # No JavaScript access
app.config['SESSION_COOKIE_SAMESITE'] = 'Lax'   # CSRF protection

from flask_session import Session
Session(app)

@app.route('/login', methods=['POST'])
def login():
    user = authenticate(request.form['username'], request.form['password'])

    if user:
        # Generate new session ID (prevent session fixation)
        session.regenerate()

        # Store minimal data in session
        session['user_id'] = user.id
        session['login_time'] = datetime.now().isoformat()
        session['ip_address'] = request.remote_addr

        return redirect('/dashboard')

    return "Invalid credentials", 401

@app.before_request
def check_session():
    if 'user_id' in session:
        # Verify IP hasn't changed (optional, may cause issues with mobile)
        if session.get('ip_address') != request.remote_addr:
            session.clear()
            return redirect('/login?reason=ip_changed')

        # Check idle timeout (30 minutes)
        last_activity = session.get('last_activity')
        if last_activity:
            idle_time = datetime.now() - datetime.fromisoformat(last_activity)
            if idle_time > timedelta(minutes=30):
                session.clear()
                return redirect('/login?reason=timeout')

        # Update last activity
        session['last_activity'] = datetime.now().isoformat()