Secure Login Code Review | Dataford Interview Questions

Secure code review of a login functionality written in Python: find vulnerabilities, mitigations, and how to implement them.

Identify weaknesses such as plaintext password handling, user enumeration, timing leaks, unlimited retries, and unsafe state updates. Implement a secure replacement.

Use def secure_login(username, password, users, attempts):. users maps usernames to records containing a PBKDF2 salt and password hash. Return a boolean and update attempts for failed or successful logins.

Constraints

username and password are strings
users is a mapping from usernames to records
Each record contains hexadecimal salt and password_hash strings
attempts maps usernames to nonnegative integer failure counts
A username is locked when its failure count is at least 5
The function returns a boolean and may mutate attempts

Function Signature

def secure_login(username, password, users, attempts):

Your question is Secure Login Code Review. Start with the requirements in the Question tab.

Run and submit as often as you like. When you're ready, talk me through your approach or go straight to the code.

Problem

Secure code review of a login functionality written in Python: find vulnerabilities, mitigations, and how to implement them.

Identify weaknesses such as plaintext password handling, user enumeration, timing leaks, unlimited retries, and unsafe state updates. Implement a secure replacement.

Constraints

username and password are strings
users is a mapping from usernames to records
Each record contains hexadecimal salt and password_hash strings
attempts maps usernames to nonnegative integer failure counts
A username is locked when its failure count is at least 5
The function returns a boolean and may mutate attempts

Function Signature

def secure_login(username, password, users, attempts):

Your question is Secure Login Code Review. Start with the requirements in the Question tab.

Run and submit as often as you like. When you're ready, talk me through your approach or go straight to the code.