This package contains a drop-in replacement middleware for django.contrib.sessions.middleware.SessionMiddleware to store all session data in a browser cookie instead of the database. The code is based on a snippet from Christopher Lenz.
To prevent user tampering the session dictionary goes through the following encoding steps:
The session dictionary is converted into JSON
A SHA1 hash is made with the JSON and the site’s SECRET_KEY
The JSON and SHA1 hash are concatenated, gzipped and base64 encoded.
Upon decoding:
The cookie is base64 decoded and ungzipped
The data is split into the SHA1 hash and the JSON data
The SHA1 hash is regenerated from the received JSON data and the site’s SECRET_KEY
If the hashes don’t match, a SuspiciousOperation exception is raised. If the hashes match, the JSON data is converted into a python object and returned.
Install
Place the cookiesession app into your INSTALLED_APPS. Next, put the cookiesession.middleware.CookieSessionMiddleware middleware into your MIDDLEWARE_CLASSES. This middleware is designed as a replacement to django.contrib.sessions.middleware.SessionMiddleware
Management Commands
Two management commands are included to make debugging things easier.
- decode_session_cookie
Called as ./manage.py decode_session_cookie <session_cookie_string> and prints the keys and values of the session dictionary.
- encode_session_cookie
Encodes key=val arguments into a cookie for manual insertion into your browser for testing purposes. You must call the command as ./manage.py encode_cookie key1=value key2=value. Prints out the encoded cookie string
1 maintainer
Metadata
1 maintainer
Release files for django-cookiesession 0.1.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| django-cookiesession-0.1.1.tar.gz | 537.4 kB | Without provenance | Details |
Security for django-cookiesession 0.1.1
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
