Improper Authentication

# myapp/auth_backends.py
from django.contrib.auth.backends import BaseBackend
# Assume StandardUser, AdminUser models exist and inherit from AbstractBaseUser or similar
from .models import StandardUser, AdminUser
from django.contrib.auth import get_user_model # Use get_user_model if applicable

class CustomAuthBackend(BaseBackend):
    def authenticate(self, request, username=None, password=None):
        user = None
        try:
            # Try finding as admin first (example logic)
            user = AdminUser.objects.get(username=username)
        except AdminUser.DoesNotExist:
            try:
                user = StandardUser.objects.get(username=username)
            except StandardUser.DoesNotExist:
                return None # No user found
        except Exception as e:
            # DANGEROUS: If DB error occurs finding AdminUser,
            # it might skip password check and return None, OR worse,
            # flawed logic might proceed assuming a user was found.
            print(f"Error finding user: {e}")
            # return None # Correct behavior is to return None on error

        # DANGEROUS: If an exception occurred above and user is None,
        # this check might be skipped or fail unexpectedly.
        # Also, check_password might be flawed if custom implemented.
        # Needs null check for user
        if user and user.check_password(password):
             return user # Return the authenticated user object
        return None # Password incorrect

# app.py (Flask) - Assume User model, find_user_by_username, session, redirect, flash exist
from werkzeug.security import check_password_hash # Import for check

@app.route('/login', methods=['POST'])
def login():
    username = request.form.get('username')
    password = request.form.get('password')
    user = find_user_by_username(username) # Assume this finds user object/dict

    # DANGEROUS: If user exists but has a NULL or empty password stored in DB,
    # and password input is also empty, this check might pass incorrectly.
    # Depends heavily on how check_password_hash handles empty/null values.
    # Also vulnerable if check_password_hash is not used at all.
    # Need to ensure user.password_hash is not null/empty before check.
    if user and user.password_hash and check_password_hash(user.password_hash, password):
         session['user_id'] = user.id
         return redirect('/dashboard')
    else:
         flash('Invalid credentials')
         return redirect('/login')

# myapp/auth_backends.py (Secure Custom Backend)
from django.contrib.auth.backends import ModelBackend # Inherit for safety
# from .models import StandardUser, AdminUser # If using custom models
from django.contrib.auth import get_user_model
from django.core.exceptions import MultipleObjectsReturned # Handle non-unique usernames

class SecureCustomAuthBackend(ModelBackend): # Inherit default checks
    def authenticate(self, request, username=None, password=None, **kwargs):
        User = get_user_model() # Allows flexibility
        if username is None:
            username = kwargs.get(User.USERNAME_FIELD) # Handle different username fields
        try:
            # Prefer finding user case-insensitively if needed and DB supports it
            user = User.objects.get(username__iexact=username)
        except User.DoesNotExist:
             # Run the default password hasher once to reduce timing leaks
             User().set_password(password)
             return None
        except MultipleObjectsReturned:
             # Should not happen if username is unique, but handle defensively
             return None
        except Exception as e:
            print(f"DB Error during user lookup: {e}")
            return None # Fail closed on error

        # SECURE: Rely on Django's built-in check_password and active check
        if user.check_password(password) and self.user_can_authenticate(user):
            return user
        return None # Password incorrect or user inactive

# app.py (Flask - Secure Check)
from werkzeug.security import check_password_hash # Import correctly

@app.route('/login-secure', methods=['POST'])
def login_secure():
    username = request.form.get('username')
    password = request.form.get('password')
    if not username or not password: # Basic check for empty submission
         flash('Username and password required')
         return redirect('/login')

    user = find_user_by_username(username) # Assume returns object with passwordHash

    # SECURE: check_password_hash handles hash comparison safely.
    # Ensure user.passwordHash exists and is not empty/null.
    if user and hasattr(user, 'passwordHash') and user.passwordHash and check_password_hash(user.passwordHash, password):
         # Regenerate session ID after login (Session Fixation defense)
         # This requires a session interface supporting regeneration, e.g., Flask-Session
         # session.regenerate() # Example name - check your session library
         session.permanent = True # Example session setting
         session['user_id'] = user.id
         return redirect('/dashboard')
    else:
         flash('Invalid credentials')
         # Add rate limiting here (CWE-307)
         return redirect('/login')