Security

dagster_authkit.auth.security

Security Hardening Module

Critical security measures to prevent common attacks.

SecurityHardening

Class with static methods for security hardening.

constant_time_compare staticmethod

constant_time_compare(a, b)

Constant time comparison to prevent timing attacks.

Critical for password, token comparisons, etc.

Parameters:

Name	Type	Description	Default
a	str	First string	required
b	str	Second string	required

Returns:

Name	Type	Description
bool	bool	True if strings are equal

generate_csrf_token staticmethod

generate_csrf_token()

Generates secure CSRF token for login forms.

Returns:

Name	Type	Description
str	str	Random 32-byte token

validate_redirect_url staticmethod

validate_redirect_url(url, allowed_hosts=None)

Validates redirect URL to prevent open redirect attacks.

Accepts only: - Relative URLs (/path) - Same host URLs - Allowed host URLs

Parameters:

Name	Type	Description	Default
url	str	URL to validate	required
allowed_hosts	list	List of allowed hosts (optional)	None

Returns:

Name	Type	Description
bool	bool	True if URL is safe

sanitize_username staticmethod

sanitize_username(username)

Sanitizes username to prevent injection attacks.

Removes dangerous characters keeping alphanumeric, underscore, hyphen, dot.

Parameters:

Name	Type	Description	Default
username	str	Raw username	required

Returns:

Name	Type	Description
str	str	Sanitized username

set_security_headers staticmethod

set_security_headers(response)

Add mandatory security headers to a Starlette Response object.

Applied headers: - X-Frame-Options: DENY - X-Content-Type-Options: nosniff - X-XSS-Protection: 1; mode=block - Referrer-Policy: strict-origin-when-cross-origin - Content-Security-Policy with script/worker/style/img/font/connect directives - Permissions-Policy restricting geolocation, microphone, camera

Parameters:

Name	Type	Description	Default
response		Starlette Response object (headers are mutated in-place).	required

Returns:

Type	Description
	The same response object (for chaining).

get_security_headers staticmethod

get_security_headers()

Returns security headers as a plain dict for ASGI send wrappers.

hash_password staticmethod

hash_password(password, salt=None)

Hashes password with BCrypt (if available) or PBKDF2.

For BCrypt, first does SHA-256 hash to: 1. Protect passwords > 72 chars (BCrypt limit) 2. Prevent null-byte truncation 3. Normalize length

Parameters:

Name	Type	Description	Default
password	str	Plain text password	required
salt	Optional[bytes]	Optional salt (bcrypt generates automatically)	None

Returns:

Name	Type	Description
str	str	Hashed password

verify_password staticmethod

verify_password(password, password_hash)

Verifies password against hash.

Supports both bcrypt and PBKDF2 fallback. For bcrypt, first does SHA-256 (same as in hashing).

Parameters:

Name	Type	Description	Default
password	str	Plain text password	required
password_hash	str	Stored hash	required

Returns:

Name	Type	Description
bool	bool	True if password is correct

generate_random_password staticmethod

generate_random_password(length=16)

Generates secure random password.

Useful for password reset, temporary passwords, etc.

Parameters:

Name	Type	Description	Default
length	int	Password length	16

Returns:

Name	Type	Description
str	str	Random password