django.git/django/contrib/auth/tokens.py, branch fix-31295

Fixed #36572 -- Revert "Fixed #36546 -- Deprecated django.utils.crypto.constant_time_compare() in favor of hmac.compare_digest()."

2025-08-27T08:50:50Z

This reverts commit 0246f478882c26bc1fe293224653074cd46a90d0.

Fixed #36546 -- Deprecated django.utils.crypto.constant_time_compare() in favor of hmac.compare_digest().

2025-08-25T12:45:16Z

Signed-off-by: SaJH

Refs #33476 -- Reformatted code with Black.

2022-02-07T19:37:05Z

Fixed #30360 -- Added support for secret key rotation.

2022-02-01T10:12:24Z

Thanks Florian Apolloner for the implementation idea. Co-authored-by: Andreas Pelme Co-authored-by: Carlton Gibson Co-authored-by: Vuyisile Ndlovu

Fixed #32664 -- Made PasswordResetTokenGenerator.secret validation lazy.

2021-04-20T05:34:53Z

Django apps initialization to run management command triggers the admin autodiscovery. Importing django.contrib.auth.tokens creates an instance of PasswordResetTokenGenerator which required a SECRET_KEY. For several management commands, the token generator is unused. It should only complain about a missing SECRET_KEY when it is used.

Refs #31842 -- Removed DEFAULT_HASHING_ALGORITHM transitional setting.

2021-01-14T16:50:04Z

Per deprecation timeline.

Refs #27468 -- Removed support for the pre-Django 3.1 password reset tokens.

2021-01-14T16:50:04Z

Per deprecation timeline.

Fixed #32130 -- Fixed pre-Django 3.1 password reset tokens validation.

2020-10-22T11:21:14Z

Thanks Gordon Wrigley for the report and implementation idea. Regression in 226ebb17290b604ef29e82fb5c1fbac3594ac163.

Fixed #26615 -- Made password reset token invalidate when changing email.

2020-10-21T07:29:53Z

Co-Authored-By: Silas Barta

Refs #31913 -- Corrected comment in PasswordResetTokenGenerator.

2020-08-27T10:57:16Z

Follow up to da4923ea87124102aae4455e947ce24599c0365b.