Browse Source

🔒 Update login.py to receive password as body (#33)

Change `new_password` from a query parameter to a body parameter for security.

(Why this is problematic is discussed in the top answer to https://stackoverflow.com/questions/2629222/are-querystring-parameters-secure-in-https-http-ssl)
pull/13907/head
dmontagu 6 years ago
committed by Sebastián Ramírez
parent
commit
546dc8bdcb
  1. 4
      {{cookiecutter.project_slug}}/backend/app/app/api/api_v1/endpoints/login.py

4
{{cookiecutter.project_slug}}/backend/app/app/api/api_v1/endpoints/login.py

@ -1,6 +1,6 @@
from datetime import timedelta
from fastapi import APIRouter, Depends, HTTPException
from fastapi import APIRouter, Body, Depends, HTTPException
from fastapi.security import OAuth2PasswordRequestForm
from sqlalchemy.orm import Session
@ -74,7 +74,7 @@ def recover_password(email: str, db: Session = Depends(get_db)):
@router.post("/reset-password/", tags=["login"], response_model=Msg)
def reset_password(token: str, new_password: str, db: Session = Depends(get_db)):
def reset_password(token: str, new_password: str = Body(...), db: Session = Depends(get_db)):
"""
Reset password
"""

Loading…
Cancel
Save