pallets-eco/secure-cookie

Secure cookies and sessions for WSGI

WSGI Secure Cookie and Session

Provides interfaces for secure cookies and sessions in WSGI applications. Secure cookies are cryptographically signed (but not encrypted) to prevent tampering. Sessions are data associated with a given user across requests and responses.

Install

Install in a virtualenv with pip:

$ pip install secure-cookie

Links

• Documentation: https://secure-cookie.readthedocs.io/
• Releases: https://pypi.org/project/secure-cookie/
• Code: https://github.com/pallets/secure-cookie
• Issue tracker: https://github.com/pallets/secure-cookie/issues
• Official chat: https://discord.gg/t6rrQZH

secure-cookie's Issues

Drop py36 support

Py36 has reached the end of its life and should not be supported anymore. I'm opening the issue for the sake of documentation, will write PR for it soon.

Broken link

The GitHub project links to https://palletsprojects.com/p/secure-cookie/ which 404s.

Support for Werkzeug 2.1.0+

Werkzeug version 2.1.0 made several changes which break secure-cookie:

• Remove safe_str_cmp function. Use equivalent in hmac modules instead.
• Remove detect_utf_encoding, it's built-in to json.loads.

Therefore, the imports no longer work.

I'll make a PR for this.

Broken link

There is a link above the directory listing: https://palletsprojects.com/p/secure-cookie/
It points to a 404 error.

Create path used by FilesystemSessionStore

secure_cookie.session.FilesystemSessionStore() does not check if the path provided as second argument exists.

If the directory, a FileNotFoundError is raised when self.store.save(session) is called.

I think the __init__() method should create automatically the directories if they don't exist.
Another solution is to raise an error in the __init__() method.

What do you think about it? I can do a PR according to your preferences.

Session store interface should be compatible with Flask

Flask has its own session interface that has probably seen much more development. First step is to investigate the differences to see what needs to be added/deprecated.

SessionMiddleware should use secure cookie to store session id

Cookie should use itsdangerous for signing

No PyPI releases

The latest version of Werkzeug deprecated things from the contrib package and points users to this library.

DeprecationWarning: 'werkzeug.contrib.sessions' is deprecated as of version 0.15 and will be removed in version 1.0. It has moved to https://github.com/pallets/secure-cookie.
DeprecationWarning: 'werkzeug.contrib.securecookie' is deprecated as of version 0.15 and will be removed in version 1.0. It has moved to https://github.com/pallets/secure-cookie.

The issue is this library appears to be incomplete and there are no releases on PyPI for it at the moment.

Copy posixemulation from Werkzeug

werkzeug.posixemulation is an internal module that was only in use by the filesystem session store. Forgot to copy it over to secure-cookie, but it will be deprecated in Werkzeug 2.0 (pallets/werkzeug#1759). Copy it over and release 0.1.1.

Would also be good to evaluate whether it's even needed anymore.

New release?

Hello,
Any plans for a new release in pypi?
The latest werkzeug version is incompatible with the latest secure-cookie.