sesame tokens seem to be missing a bunch of entropy on my Django installation (first characters are all 'AAAAAA'

[joshburnett]

sesame tokens seem to be missing a bunch of entropy on my Django installation (first characters are all 'AAAAAA'

[adamchainz]

This is expected behaviour - sesame uses the struct library to encode your user primary key: https://github.com/aaugustin/django-sesame/blob/main/src/sesame/packers.py . It then base64 encodes this:

django-sesame/src/sesame/tokens_v2.py

Lines 124 to 139 in 7edd0a4

	def create_token(user, scope=""):
	"""
	Create a v2 signed token for a user.
	"""
	primary_key = packers.packer.pack_pk(user.pk)
	timestamp = pack_timestamp()
	revocation_key = get_revocation_key(user)
	signature = sign(primary_key + timestamp + revocation_key + scope.encode())
	# If the revocation key changes, the signature becomes invalid, so we
	# don't need to include a hash of the revocation key in the token.
	data = primary_key + timestamp + signature
	token = base64.urlsafe_b64encode(data).rstrip(b"=")
	return token.decode()

.

For BigAutoField, it will encodes 8 bytes, for example for user ID 1 you'll see AAAAAAAAAAE (the trailing = is not required):

>>> import struct
>>> struct.pack('!q', 1)
b'\x00\x00\x00\x00\x00\x00\x00\x01'
>>> import base64
>>> base64.b64encode(struct.pack('!q', 1))
b'AAAAAAAAAAE='

Perhaps the docs examples could be updated to show this. Would you like to make a PR?

[joshburnett]

Ahh, I see. The docs do briefly mention this in the 'Tokens security' section but don't give an example, so I just rolled right over it. I didn't think about it until I noticed that the tokens that I'm generating look very different than the example ones shown.

I'll think about pulling together a PR to put just a little more detail there. I'll probably also investigate how hard it is to write a custom packer, though I'm not sure it's really worth it for my particular low-stakes application.

Thanks again for creating this library, and for clearly already putting a bunch of work into the docs. Overall they are really quite good!

[aaugustin]

This deserves at least an entry in the Infrequently asked questions section of the README.