Weak Password Reset Token

Description

Detects password reset tokens generated using weak or predictable methods like timestamps or non-cryptographic random.

How to fix

Use the secrets module for cryptographically secure token generation.

```python
import secrets
token = secrets.token_urlsafe(32)
```

Learn more: https://shoulder.dev/learn/python/cwe-640/weak-password-reset-token

Applies to

Languages

🐍 Python

Frameworks

django flask fastapi

References

Documentation ↗ OWASP ↗ Learn about CWE-640

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=python-weak-reset-token .