Added support for setting a custom SESSION_DIGEST_METHOD in pgAdmin 4 to facilitate FIPS compliance. #7979

web/config.py

@@ -365,6 +365,9 @@ SESSION_DB_PATH = os.path.join(DATA_DIR, 'sessions')
 
 SESSION_COOKIE_NAME = 'pga4_session'
 
+# Session digest method
+SESSION_DIGEST_METHOD = 'hashlib.sha1'
+
 ##########################################################################
 # Mail server settings
 ##########################################################################

web/pgadmin/utils/session.py

@@ -31,6 +31,7 @@ from flask_login import login_url
 
 from pickle import dump, load
 from collections import OrderedDict
+from itsdangerous import signer
 
 from flask.sessions import SessionInterface, SessionMixin
 from werkzeug.datastructures import CallbackDict
@@ -286,6 +287,8 @@ class FileBackedSessionManager(SessionManager):
 class ManagedSessionInterface(SessionInterface):
     def __init__(self, manager):
         self.manager = manager
+        signer.Signer.default_digest_method = \
+            eval(config.SESSION_DIGEST_METHOD)
 
     def open_session(self, app, request):
         cookie_val = request.cookies.get(app.config['SESSION_COOKIE_NAME'])