Bump flask-security-too from 5.1.2 to 5.3.0

[dependabot]

Bumps flask-security-too from 5.1.2 to 5.3.0.

Release notes

Sourced from flask-security-too's releases.

Release 5.3.0

Improvements to recoverability and confirmation to align with OWASP best practices and reduce possible exploitation.

See Changes for complete list and any backwards compatibility concerns.

Release 5.2.0

Small updates to work with latest Flask/Werkzeug.

Drop support for Python 3.7 Drop support for older versions of dependent packages (such as Flask).

Changelog

Sourced from flask-security-too's changelog.

Version 5.3.0

Released July 27, 2023

This is a minor version bump due to some small backwards incompatible changes to WebAuthn, recoverability (/reset), confirmation (/confirm) and the two factor validity feature.

Fixes ++++++

• (:pr:807) Webauthn Updates to handling of transport.
• (:pr:809) Fix MongoDB support by eliminating dependency on flask-mongoengine. Improve MongoDB quickstart.
• (:issue:801) Fix Quickstart for SQLAlchemy with scoped session.
• (:issue:806) Login no longer, by default, checks for email deliverability.
• (:issue:791) Token authentication is no longer accepted on endpoints which only allow 'session' as authentication-method. (N247S)
• (:issue:814) /reset and /confirm and GENERIC_RESPONSES and additional form args don't mix.
• (:issue:281) Reset password can be exploited and other OWASP improvements.
• (:pr:817) Confirmation can be exploited and other OWASP improvements.
• (:pr:819) Convert to pyproject.toml, build, remove setup.py/.cfg.
• (:pr:823) the tf_validity feature now ONLY sets a cookie - and the token is no longer returned as part of a JSON response.
• (:pr:825) Fix login/unified signin templates to properly send CSRF token. Add more tests.
• (:pr:826) Improve Social Oauth example code.

Backwards Compatibility Concerns +++++++++++++++++++++++++++++++++

• To align with the W3C WebAuthn Level2 and 3 spec - transports are now part of the registration response. This has been changed BOTH in the server code (using webauthn data structures) as well as the sample javascript code. If an application has their own javascript front end code - it might need to be changed.

• The tf_validity feature :py:dataSECURITY_TWO_FACTOR_ALWAYS_VALIDATE used to set a cookie if the request was form based, and return the token as part of a JSON response. Now, this feature is ONLY cookie based and the token is no longer returned as part of any response.

• Reset password was changed to adhere to OWASP recommendations and reduce possible exploitation:

  • A new email (with new token) is no longer sent upon expired token. Users must restart the reset password process.
  • The user is no longer automatically logged in upon successful password reset. For backwards compatibility :py:data:SECURITY_AUTO_LOGIN_AFTER_RESET can be set to True. Note that this compatibility feature is deprecated and will be removed in a future release.
  • Identity information (identity, email) is no longer sent as part of the URL redirect query params.
  • The SECURITY_MSG_PASSWORD_RESET_EXPIRED message no longer contains the user's identity/email.
  • The default for :py:data:SECURITY_RESET_PASSWORD_WITHIN has been changed from 5 days to 1 days.
  • The response to GET /reset/ sets the HTTP header Referrer-Policy to no-referrer as suggested by OWASP.

• Confirm email was changed to adhere to OWASP recommendations and reduce possible exploitation:

... (truncated)

Commits

• da27bb0 Final tweaks for 5.3 (#827)
• c1f6d75 Improve Social Oauth example code. (#826)
• d7f68ba Fix login and unified signin templates to send CSRF tokens. (#825)
• a6d57f5 Update sphinx requirement from ~=7.0 to ~=7.1 in /requirements (#824)
• 9dcf7ec TWO_FACTOR_VALIDITY changes. (#823)
• 58f93ef Change confirmation to default to NOT auto-login. (#820)
• 2750b9a Convert distribution build to 'build' (#819)
• bf59f63 Improve /confirm w.r.t. OWASP (#817)
• ed5c824 Improve /reset w.r.t. OWASP (#816)
• bf5a31f Improve /reset and /confirm w.r.t. GENERIC_RESPONSES and additional form args...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)