--- a/cubicweb/web/webconfig.py	Tue Apr 23 09:33:52 2019 +0200
+++ b/cubicweb/web/webconfig.py	Fri Apr 12 12:31:14 2019 +0200
@@ -302,7 +302,8 @@
         # replace \r\n so we do not depend on whether a browser "reencode"
         # original message using \r\n or not
         return hmac.new(self._instance_salt,
-                        text.strip().replace(b'\r\n', b'\n')).hexdigest()
+                        text.strip().replace(b'\r\n', b'\n'),
+                        digestmod="sha3_512").hexdigest()
 
     def check_text_sign(self, text, signature):
         """check the text signature is equal to the given signature"""