Comments (2)
To load a cookie beaker knows two classes: SimpleCookie
and a their special SignedCookie
. Now, if you use the normal session, i.e. not a pure cookie one, then it uses the secret
to validate the cookie signature. Otherwise it uses the validate_key
. In your case you chose a combination of validate_key
and the normal server-side session.
I think this is a security flaw with beaker: It should not be that the two different types use different parameters for their signature. Instead, both should either use the secret
or validate_key
for the validation of a signed cookie. But even if this can't be fixed for compatibility reasons, then beaker needs to be clear on this: The note telling you to drop the secret refer specifically to the encrypted cookie which seems to be only relevant to client-side cookies.
from beaker.
This is still in the latest docs; was it fixed?
from beaker.
Related Issues (20)
- Python 3.10 : Threading related deprecations HOT 1
- 1.11.0: test suite is failing HOT 1
- Beaker Maintainership
- Incapable to disable cache after modified region settings
- Resource consumption dos from way back
- Update beaker in pip
- 1.11.0: test suite uses outdated `nose` module HOT 2
- License file is missing in package
- Does it supports Python 3.9 version? HOT 1
- Deserialization of Untrusted Data
- Using cache.type='ext:database' doesn't work in V 1.12.0 HOT 6
- Error when loading session from 1.11 on 1.12
- CVE-2013-7489
- when "cookie: null;beaker.session.id=a70c9bbdcf6242f393de98847a4982ca"
- Some much-needed features about caching HOT 1
- How can i update expire time per call or refresh page
- Can't connect to several nodes and/or in cluster mode HOT 1
- 1.12.1 + master (91aa4d89): pytest fails HOT 5
- RFE: drop python<=3.7 support HOT 5
- beaker.session class documentation wrong about cookie_expires (expiration of the session cookie)
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from beaker.