To prevent timing attacks against the state token, use constant_time_compare instead of the == to compare the request state token against the session state token Issue to fix: https://github.com/python-social-auth/social-core/issues/133 Security concern: https://cryptocoding.net/index.php/Coding_rules#Compare_secret_strings_in_constant_time
To prevent timing attacks against the state token, use constant_time_compare
instead of the == to compare the request state token against the session state token
Issue to fix: https://github.com/python-social-auth/social-core/issues/133
Security concern: https://cryptocoding.net/index.php/Coding_rules#Compare_secret_strings_in_constant_time

python-social-auth/social-core,python-social-auth/social-core