OWASP Top 10 — A02:2021 Cryptographic Failures

from flask import Flask, request, redirect, render_template_string, session, url_for
import jwt
import hashlib, base64

app = Flask(__name__)
app.secret_key = 'secret'
JWT_SECRET = 'myjwtsecret'

users = {
    "admin": {"password": "admin123", "role": "admin"},
    "alice": {"password": "alice123", "role": "user"},
    "bob": {"password": "bob123", "role": "user"}
}

login_template = '''
<h2>Login</h2>
<form method="POST">
  <input name="username" placeholder="Username"><br>
  <input name="password" placeholder="Password" type="password"><br>
  <button type="submit">Login</button>
</form>
'''

protected_template = '''
<h2>Welcome, {{ username }} ({{ role }})</h2>
<p>Your JWT token:</p>
<code>{{ token }}</code><br>
<p>MD5 password hash: <code>{{ password_hash }}</code></p>
<p>Password base64: <code>{{ password_base64 }}</code></p>
<br>
<a href="/logout">Logout</a>
'''

@app.route('/', methods=["GET"])
def home():
    return redirect(url_for('login'))

@app.route('/login', methods=["GET", "POST"])
def login():
    if request.method == "POST":
        username = request.form.get('username')
        password = request.form.get('password')
        user = users.get(username)

        if user and user["password"] == password:
            token = jwt.encode({"user": username, "role": user["role"]}, JWT_SECRET, algorithm="HS256")
            session['token'] = token
            return redirect(url_for('protected'))
        else:
            return "Invalid credentials", 403
    return render_template_string(login_template)

@app.route('/protected')
def protected():
    auth_header = request.headers.get('Authorization')
    token = session.get('token')

    if auth_header and auth_header.startswith("Bearer "):
        token = auth_header.split(" ")[1]

    if token:
        try:
            decoded = jwt.decode(token, JWT_SECRET, algorithms=["HS256", "none"], options={"verify_signature": False})
            username = decoded.get("user")
            role = decoded.get("role")
            password = users.get(username, {}).get("password", "unknown")
            password_hash = hashlib.md5(password.encode()).hexdigest()
            password_base64 = base64.b64encode(password.encode()).decode()
            return render_template_string(protected_template, username=username, role=role, token=token, password_hash=password_hash, password_base64=password_base64)
        except Exception as e:
            return f"Invalid token: {e}", 403

    return redirect(url_for("login"))

@app.route('/logout')
def logout():
    session.clear()
    return redirect(url_for('login'))

if __name__ == "__main__":
    app.run(debug=True)