You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
It looks like the default/recommended signatureAlgorithm in the documentation uses SHA-1, which is no longer considered secure. Can this be changed to SHA-256?
OK -- I'd encourage you to change that default and just document the change in the release notes. I don't think backward-compatibility is a good reason to default to a known insecure algorithm (which basically means all downstream projects, like python-social-auth which uses the default SECURITY settings, will be insecure).
If you're not able to change the default here, I guess I'll open an issue with python-social-auth for them to fix it.
It looks like the default/recommended signatureAlgorithm in the documentation uses SHA-1, which is no longer considered secure. Can this be changed to SHA-256?
The text was updated successfully, but these errors were encountered: