Configuration should be 'secure by default'

All security libs should be secure by default. Flask-security is not. This prevents flask-security from being run ‘off the shelf’.

SECURITY_PASSWORD_HASH is plaintext by default. This should default to perhaps bcrypt. SECURITY_PASSWORD_SALT is None by default. This should be set to a valid default. Although that would mean a common salt between any vanilla installs, any salt is better than None.

[corydolphin]

A default has already been chosen. And that default is the least secure of plausible options. I think it should be changed.

@adamlwgriffiths I too am surprised by this default behavior and I believe that it should be changed.

@mattupstate I believe that currently a decision is made on the encryption algorithm default, and that is to use the least secure one possible. What if the default was set to ‘bcrypt’, and a warning logged if the SECURITY_PASSWORD_SALT key is not set in app.config?

I believe this would both improve the out-of-box security of Flask-Security (and the flask ecosystem as a whole!), and ensure that everyone makes a decision on the encryption algorithm.

[PierreRochard]

@adamlwgriffiths Your hearts in the right place and I agree with you, but necro-posting like this is not constructive. I highly encourage you to submit a pull request that takes into account the feedback provided in this thread 1.5 years ago.