trusheim/Django-WebAuth — pull request #1 by jchen5 (2014-06-11 21:22:08+00:00)
Title: Fixes several security vulnerabilities

Most important changes:
- Replaces SHA1(key | message), which is not a secure MAC, with HMAC.
- Removes useless nonce. To actually provide some defense against
e.g. replay attacks, the django side should provide freshness, or the
webauth side should provide a timestamp. In fact, the nonce is worse than
useless, because it (along with the careless way in which it's used)
enables several other attacks.
- Ignores next URL to prevent CSRF attacks