Increase session randomness to 32 bytes

issue6682
review35521002

CHANGELOG

@@ -1,3 +1,4 @@
+* Increase session randomness to 32 bytes
 * Allow to specify datetime related values in XML files
 * Add environment variables to wsgi script
 * Add unique ids check on RPC

trytond/ir/session.py

@@ -1,8 +1,16 @@
 # This file is part of Tryton.  The COPYRIGHT file at the top level of
 # this repository contains the full copyright notices and license terms.
-import json
-import uuid
+import binascii
 import datetime
+import json
+import os
+try:
+    from secrets import token_hex
+except ImportError:
+    def token_hex(nbytes=None):
+        if nbytes is None:
+            nbytes = 32
+        return binascii.hexlify(os.urandom(nbytes)).decode('ascii')
 
 from trytond.model import ModelSQL, fields
 from trytond.config import config
@@ -33,9 +41,9 @@ class Session(ModelSQL):
         table = TableHandler(cls, module_name)
         table.index_action('create_uid', 'add')
 
-    @staticmethod
-    def default_key():
-        return uuid.uuid4().hex
+    @classmethod
+    def default_key(cls, nbytes=None):
+        return token_hex(nbytes)
 
     @classmethod
     def check(cls, user, key):