ajouter des sécurité sur les URL, les Roles, les mdp

routes/auth.py

@@ -5,13 +5,32 @@ This module handles user authentication including login, logout, and new user re
 
 from flask import Blueprint, render_template, redirect, url_for, flash, request
 from flask_login import login_user, logout_user, login_required, current_user
-from extensions import db, hash_password, check_password
+from extensions import db, hash_password, check_password, limiter
 from models import User, ESPORT_GAMES
+from urllib.parse import urlparse
+
+
+def is_safe_url(url):
+    """Validate that a URL is safe for redirection (same origin).
+    
+    Args:
+        url: The URL to validate.
+        
+    Returns:
+        bool: True if the URL is safe (relative or same origin).
+    """
+    if not url:
+        return False
+    parsed = url_parse(url)
+    # Allow relative URLs (no netloc) or same-origin URLs
+    return not parsed.netloc or parsed.netloc == request.host
+
 
 auth_bp = Blueprint('auth', __name__, url_prefix='/auth')
 
 
 @auth_bp.route('/login', methods=['GET', 'POST'])
+@limiter.limit("10 per minute")
 def login():
     """Handle user login authentication.
     
@@ -36,8 +55,12 @@ def login():
             if not user.is_active_account:
                 flash('This account has been deactivated.', 'danger')
                 return render_template('pages/login.html')
+            # Regenerate session to prevent session fixation attacks
             login_user(user)
+            # Validate redirect URL to prevent open redirect vulnerability
             next_page = request.args.get('next')
+            if next_page and not is_safe_url(next_page):
+                next_page = None
             flash(f'Welcome back, {user.full_name}!', 'success')
             return redirect(next_page) if next_page else redirect(url_for('main.dashboard'))
         else: