Fix bug with an invalid remember_token cookie value

flask_security/core.py

@@ -9,7 +9,7 @@
     :license: MIT, see LICENSE for more details.
 """
 
-from itsdangerous import URLSafeTimedSerializer
+from itsdangerous import URLSafeTimedSerializer, BadSignature
 from flask import current_app
 from flask.ext.login import AnonymousUser as AnonymousUserBase, \
      UserMixin as BaseUserMixin, LoginManager, current_user
@@ -97,9 +97,13 @@ def _user_loader(user_id):
 
 
 def _token_loader(token):
-    data = _security.remember_token_serializer.loads(token)
-    user = _security.datastore.find_user(id=data[0])
-    return user if md5(user.password) == data[1] else None
+    try:
+        data = _security.remember_token_serializer.loads(token)
+        user = _security.datastore.find_user(id=data[0])
+        return user if md5(user.password) == data[1] else None
+    except:
+        print 'word'
+        return None
 
 
 def _identity_loader():

tests/functional_tests.py

@@ -5,6 +5,8 @@ from __future__ import with_statement
 import base64
 import time
 
+from cookielib import Cookie
+
 try:
     import simplejson as json
 except ImportError:
@@ -190,6 +192,11 @@ class DefaultSecurityTests(SecurityTest):
         r = self._get('/profile')
         self.assertIn('profile', r.data)
 
+    def test_token_loader_does_not_fail_with_invalid_token(self):
+        self.client.cookie_jar.set_cookie(Cookie(version=0, name='remember_token', value='None', port=None, port_specified=False, domain='www.example.com', domain_specified=False, domain_initial_dot=False, path='/', path_specified=True, secure=False, expires=None, discard=True, comment=None, comment_url=None, rest={'HttpOnly': None}, rfc2109=False))
+        r = self._get('/')
+        self.assertNotIn('BadSignature', r.data)
+
 
 class ConfiguredSecurityTests(SecurityTest):