removed usage of safe_str_cmp of werkzeug. using hmac.compare_digest instead (flasgger#532)

jayashankarjayan · web-flow · commit 66967637ed71 · 2023-05-05T09:56:03.000-07:00
diff --git a/examples/jwt_auth.py b/examples/jwt_auth.py
@@ -31,10 +31,9 @@
 using basic HTTP auth on some web-server you will have to.
 """
 
-
+import hmac
 from flask import Flask, jsonify, request
 from flask_jwt import JWT, jwt_required, current_identity, JWTError
-from werkzeug.security import safe_str_cmp
 from flasgger import Swagger
 
 
@@ -58,7 +57,7 @@ def __str__(self):
 
 def authenticate(username, password):
     user = username_table.get(username, None)
-    if user and safe_str_cmp(user.password.encode('utf-8'), password.encode('utf-8')):
+    if user and hmac.compare_digest(user.password.encode('utf-8'), password.encode('utf-8')):
         return user
 
 
