django.utils.crypto should use secrets on Python 3.6+

[Adam Johnson]

Aymeric discussing django.utils.crypto on ​mailing list:

While we’re there, we should use ​https://docs.python.org/3/library/secrets.html#module-secrets on Python >= 3.6.

[Tim Graham]

Specifically, it looks like that means in place of random.SystemRandom.

[Anton Samarchyan]

Added ​PR

[Tim Graham]

Python's secrets.py does from random import SystemRandom so this doesn't change any behavior or add security for now. Adam said, "Presumably the intention is that secrets might one day use a different PRNG's on some OS's." Let's make the change if the benefits become more than theoretical or when only Python 3.6+ is supported.

Another possibility Aymeric mentioned, "In the long run I think we should deprecate get_random_string in favor of similar functions provided by the secrets module. I didn't check whether there was a sensible transition plan to make use of secrets on Python 3.6 while still supporting older versions."

[Emett Speer]

Replying to Tim Graham:

Python's secrets.py does from random import SystemRandom so this doesn't change any behavior or add security for now. Adam said, "Presumably the intention is that secrets might one day use a different PRNG's on some OS's." Let's make the change if the benefits become more than theoretical or when only Python 3.6+ is supported.

Another possibility Aymeric mentioned, "In the long run I think we should deprecate get_random_string in favor of similar functions provided by the secrets module. I didn't check whether there was a sensible transition plan to make use of secrets on Python 3.6 while still supporting older versions."

I'm with you on this. The vast majority of people are not going to use this for a long time and it will add an extra bit of overhead just to support an update in a single version of Python none of the big distros ship. Once more of the Django community has migrated to Python3.6+ it would be worth looking into.

[Claude Paroz]

New ​PR now we are on 3.6+.

[Nick Pope]

Alternate ​PR addressing the non-working fallback and optionally stripping it out based on ​my comment.

[Mariusz Felisiak <felisiak.mariusz@…>]

In 068005a3:

Refs #27635 -- Removed fallback when SystemRandom() isn't available that doesn't work.

Fallback was untested and likely never triggered.

[Mariusz Felisiak <felisiak.mariusz@…>]

In 1d0bab0:

Fixed #27635 -- Used secrets module in django.utils.crypto.