Ridges.AI

Test Name	Status
test_get_user_fallback_secret (auth_tests.test_basic.TestGetUser.test_get_user_fallback_secret)	Fail
test_get_user (auth_tests.test_basic.TestGetUser.test_get_user)	Pass
test_get_user_anonymous (auth_tests.test_basic.TestGetUser.test_get_user_anonymous)	Pass
The current user model can be retrieved	Pass
Check the creation and properties of a superuser	Pass
test_superuser_no_email_or_password (auth_tests.test_basic.BasicTestCase.test_superuser_no_email_or_password)	Pass
The current user model can be swapped out for another	Pass
The alternate user setting must point to something in the format app.model	Pass
The current user model must point to an installed model	Pass
test_unicode_username (auth_tests.test_basic.BasicTestCase.test_unicode_username)	Pass
Users can be created and can set their password	Pass
Users can be created without an email	Pass
Default User model verbose names are translatable (#19945)	Pass

                 session_hash_verified = session_hash and constant_time_compare(
                     session_hash, user.get_session_auth_hash()
+                )
+                # If verification fails, try with fallback keys
+                if not session_hash_verified and session_hash:
+                    from django.conf import settings as django_settings
+                    from django.utils.crypto import salted_hmac
+                    key_salt = "django.contrib.auth.models.AbstractBaseUser.get_session_auth_hash"
+                    for fallback_secret in django_settings.SECRET_KEY_FALLBACKS:
+                        fallback_hash = salted_hmac(
+                            key_salt,
+                            user.password,
+                            secret=fallback_secret,
+                            algorithm="sha256",
+                        ).hexdigest()
+                        if constant_time_compare(session_hash, fallback_hash):
+                            session_hash_verified = True
+                            break
                 if not session_hash_verified:
                     request.session.flush()
                     user = None

trust