Refs #27468 -- Made user sessions use SHA-256 algorithm.

2 files changed, 13 insertions, 3 deletions

diff --git a/django/contrib/auth/__init__.py b/django/contrib/auth/__init__.py
index 09db690b5c..de2aa785e6 100644
--- a/django/contrib/auth/__init__.py
+++ b/django/contrib/auth/__init__.py
@@ -187,8 +187,13 @@ def get_user(request):
                     user.get_session_auth_hash()
                 )
                 if not session_hash_verified:
-                    request.session.flush()
-                    user = None
+                    if not (
+                        session_hash and
+                        hasattr(user, '_legacy_get_session_auth_hash') and
+                        constant_time_compare(session_hash, user._legacy_get_session_auth_hash())
+                    ):
+                        request.session.flush()
+                        user = None
 
     return user or AnonymousUser()
 
diff --git a/django/contrib/auth/base_user.py b/django/contrib/auth/base_user.py
index f39c12a350..bb51cfbcc9 100644
--- a/django/contrib/auth/base_user.py
+++ b/django/contrib/auth/base_user.py
@@ -120,12 +120,17 @@ class AbstractBaseUser(models.Model):
         """
         return is_password_usable(self.password)
 
+    def _legacy_get_session_auth_hash(self):
+        # RemovedInDjango40Warning: pre-Django 3.1 hashes will be invalid.
+        key_salt = 'django.contrib.auth.models.AbstractBaseUser.get_session_auth_hash'
+        return salted_hmac(key_salt, self.password, algorithm='sha1').hexdigest()
+
     def get_session_auth_hash(self):
         """
         Return an HMAC of the password field.
         """
         key_salt = "django.contrib.auth.models.AbstractBaseUser.get_session_auth_hash"
-        return salted_hmac(key_salt, self.password).hexdigest()
+        return salted_hmac(key_salt, self.password, algorithm='sha256').hexdigest()
 
     @classmethod
     def get_email_field_name(cls):