From 476d1500c6b0673863a995761c68c01b382139d2 Mon Sep 17 00:00:00 2001 From: Andrew Godwin Date: Tue, 28 Mar 2017 11:38:05 -0700 Subject: [PATCH] Switch from MD5 to SHA-1 to work under FIPS-140-2 --- channels/sessions.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/channels/sessions.py b/channels/sessions.py index 3af6da9..3e43f80 100644 --- a/channels/sessions.py +++ b/channels/sessions.py @@ -18,7 +18,7 @@ def session_for_reply_channel(reply_channel): """ # We hash the whole reply channel name and add a prefix, to fit inside 32B reply_name = reply_channel - hashed = hashlib.md5(reply_name.encode("utf8")).hexdigest() + hashed = hashlib.sha1(reply_name.encode("utf8")).hexdigest() session_key = "chn" + hashed[:29] # Make a session storage session_engine = import_module(getattr(settings, "CHANNEL_SESSION_ENGINE", settings.SESSION_ENGINE))