username/flaskpaste
1
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: share PoW HMAC secret across gunicorn workers
Some checks failed
CI / Lint & Format (push) Failing after 29s
Details
CI / Unit Tests (push) Has been skipped
Details
CI / Memory Leak Check (push) Has been skipped
Details
CI / Fuzz Testing (push) Has been skipped
Details
CI / SBOM Generation (push) Has been skipped
Details
CI / Security Scan (push) Successful in 34s
Details
CI / Security Tests (push) Has been skipped
Details
CI / Advanced Security Tests (push) Has been skipped
Details
CI / Build & Push Image (push) Has been skipped
Details
CI / Harbor Vulnerability Scan (push) Has been skipped
Details

Browse Source 
get_pow_secret() generated a random secret per process, so challenges
signed by worker A failed verification on worker B (~90% failure rate
with 2 workers).  Persist a file-backed secret to data/.pow_secret
using O_EXCL for atomic creation.  FLASKPASTE_POW_SECRET env var
still takes priority when configured.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
user
2026-02-23 21:32:06 +01:00
parent ca1cbd6e73
commit e7c278be0d
3 changed files with 33 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored
View File

@@ -32,6 +32,7 @@ data/*.db-shm
*.pem
*.key
keys/
data/.pow_secret
# Build
dist/