[Django] #3285: [patch] django.contrib.signed_cookies proposal

[Django]

#3285: [patch] django.contrib.signed_cookies proposal
--------------------------------------------------------------+-------------
Reporter: Marty Alchin (Gulopine) <gulo...@gamemusic.org> | Owner: adrian
Type: enhancement | Status: new
Priority: normal | Milestone:
Component: Contrib apps | Version:
Severity: normal | Keywords:
--------------------------------------------------------------+-------------
In response to some discussion on Chapter 20 of the Django book, and
Jacob's suggestion on django-users ([http://groups.google.com/group/
django-users/browse_thread/thread/cf05d6559b9b05fe/ here]), this is a
proposal for a `contrib` app (tentatively called
`django.contrib.signed_cookies`) to implement signed cookies throughout a
Django project.

The only setting necessary to activate it is the inclusion of the
middleware class to `MIDDLEWARE_CLASSES`, as it uses the existing
`SECRET_KEY` setting to help generate the signature used to authenticate
the cookies. Its position in `MIDDLEWARE_CLASSES` matters, as it
transparently handles the signature encryption, validation and signature
removal, so that other middlewares and views don't need to have any
knowledge of its presence.

* Each new cookie's name and value is taken along with the site's
`SECRET_KEY` to generate a digest signature
* The signature is then prepended to the cookie's value.
* When a request comes in, it then recalculates the digest and validates
it against the signature it contains.
* If the cookie doesn't contain a signature, or if it fails to validate,
the cookie is removed from `request.COOKIES`.
* In this case, the view would usually reset the cookie, at which point
it would be signed properly.
* If all succeeds, the signature is removed from the cookie's value in
`request.COOKIES`.

Currently it uses MD5, but could easily be adapted to use a setting that
would control which digest utility is used to generate the signature.

--
Ticket URL: <http://code.djangoproject.com/ticket/3285>
Django <http://code.djangoproject.org/>
The web framework for perfectionists with deadlines.

[Django Code]

#3285: [patch] django.contrib.signed_cookies proposal
----------------------------------------------------------------+-----------

Reporter: Marty Alchin (Gulopine) <gulo...@gamemusic.org> | Owner: adrian

Status: new | Component: Contrib apps
Version: | Resolution:
Keywords: | Stage: Design decision needed
Has_patch: 1 | Needs_docs: 0
Needs_tests: 0 | Needs_better_patch: 0
----------------------------------------------------------------+-----------
Changes (by SmileyChris):

* stage: Unreviewed => Design decision needed

Comment:

Looks good, Marty! Is there a way to write some tests for this middleware?

I'm going to mark this as "decision needed" and let the core decide on
whether this is viable.

--
Ticket URL: <http://code.djangoproject.com/ticket/3285#comment:1>
Django Code <http://code.djangoproject.com/>

[Django Code]

#3285: [patch] django.contrib.signed_cookies proposal
----------------------------------------------------------------+-----------
Reporter: Marty Alchin (Gulopine) <gulo...@gamemusic.org> | Owner: adrian
Status: new | Component: Contrib apps
Version: | Resolution:
Keywords: | Stage: Design decision needed
Has_patch: 1 | Needs_docs: 0
Needs_tests: 0 | Needs_better_patch: 0
----------------------------------------------------------------+-----------

Comment (by Marty Alchin <gulo...@gamemusic.org>):

Tests for it should be fairly straightforward, I'll get to work on them
this weekend.

--
Ticket URL: <http://code.djangoproject.com/ticket/3285#comment:2>

[Django Code]

#3285: [patch] django.contrib.signed_cookies proposal
----------------------------------------------------------------+-----------
Reporter: Marty Alchin (Gulopine) <gulo...@gamemusic.org> | Owner: adrian
Status: new | Component: Contrib apps
Version: | Resolution:
Keywords: | Stage: Design decision needed
Has_patch: 1 | Needs_docs: 0
Needs_tests: 0 | Needs_better_patch: 0
----------------------------------------------------------------+-----------
Comment (by Marty Alchin <gulo...@gamemusic.org>):

Not that it should matter, but `test_delete_cookie` in the provided test
suite fails in Django 0.95, due to #2503. However, since `delete_cookie`
is only called in the test suite, the middleware itself functions
propertly, even in 0.95.

--
Ticket URL: <http://code.djangoproject.com/ticket/3285#comment:3>

[Django Code]

#3285: [patch] django.contrib.signed_cookies proposal
----------------------------------------------------------------+-----------
Reporter: Marty Alchin (Gulopine) <gulo...@gamemusic.org> | Owner: adrian

Status: closed | Component: Contrib apps
Version: | Resolution: invalid

Keywords: | Stage: Design decision needed
Has_patch: 1 | Needs_docs: 0
Needs_tests: 0 | Needs_better_patch: 0
----------------------------------------------------------------+-----------

Changes (by sh_sa...@yahoo.com):

* status: new => closed
* resolution: => invalid

Comment:

Can anybody help me? I have problem by cookies. I want to have two kind of
cookie: permanent and temporary. Temporary cookie should be deleted when
browser close. I don't want to use "SESSION_EXPIRE_AT_BROWSER_CLOSE"
because that will delete all part of cookies but I want to temporary part
to delete. Can you know how I shall do that? Can I have two sessions in my
code or any event for closing browser exists? I can't use "unload"
JavaScript events because that is call when URL is change, in my test the
URL will be change page by page, I want to delete temporary cookie
whenever browser close.
Thanks a lot

--
Ticket URL: <http://code.djangoproject.com/ticket/3285#comment:4>

[Django Code]

#3285: [patch] django.contrib.signed_cookies proposal
----------------------------------------------------------------+-----------
Reporter: Marty Alchin (Gulopine) <gulo...@gamemusic.org> | Owner: adrian

Status: reopened | Component: Contrib apps
Version: | Resolution:

Keywords: | Stage: Design decision needed
Has_patch: 1 | Needs_docs: 0
Needs_tests: 0 | Needs_better_patch: 0
----------------------------------------------------------------+-----------

Changes (by anonymous):

* status: closed => reopened
* resolution: invalid =>

Comment:



--
Ticket URL: <http://code.djangoproject.com/ticket/3285#comment:5>

[Django Code]

#3285: [patch] django.contrib.signed_cookies proposal
----------------------------------------------------------------+-----------
Reporter: Marty Alchin (Gulopine) <gulo...@gamemusic.org> | Owner: adrian

Status: closed | Component: Contrib apps
Version: | Resolution: invalid

Keywords: | Stage: Design decision needed
Has_patch: 1 | Needs_docs: 0
Needs_tests: 0 | Needs_better_patch: 0
----------------------------------------------------------------+-----------

Changes (by sh_sa...@yahoo.com):

* status: reopened => closed

* resolution: => invalid

Comment:

Can anybody help me? I have problem by cookies. I want to have two kind of
cookie: permanent and temporary. Temporary cookie should be deleted when
browser close. I don't want to use "SESSION_EXPIRE_AT_BROWSER_CLOSE"
because that will delete all part of cookies but I want to temporary part
to delete. Can you know how I shall do that? Can I have two sessions in my
code or any event for closing browser exists? I can't use "unload"

JavaScript? events because that is call when URL is change, in my test the

URL will be change page by page, I want to delete temporary cookie
whenever browser close. Thanks a lot

--
Ticket URL: <http://code.djangoproject.com/ticket/3285#comment:6>

[Django Code]

#3285: [patch] django.contrib.signed_cookies proposal
----------------------------------------------------------------+-----------
Reporter: Marty Alchin (Gulopine) <gulo...@gamemusic.org> | Owner: adrian

Status: reopened | Component: Contrib apps
Version: | Resolution:

Keywords: | Stage: Design decision needed
Has_patch: 1 | Needs_docs: 0
Needs_tests: 0 | Needs_better_patch: 0
----------------------------------------------------------------+-----------

Changes (by Michael Radziej <m...@noris.de>):

* status: closed => reopened
* resolution: invalid =>

Comment:

Please go to the django-users mailing list for user support. Tickets are
for bug reports and enhancement requests.

--
Ticket URL: <http://code.djangoproject.com/ticket/3285#comment:7>

[Django Code]

#3285: [patch] django.contrib.signed_cookies proposal
----------------------------------------------------------------+-----------
Reporter: Marty Alchin (Gulopine) <gulo...@gamemusic.org> | Owner: adrian
Status: reopened | Component: Contrib apps
Version: | Resolution:
Keywords: | Stage: Design decision needed
Has_patch: 1 | Needs_docs: 0
Needs_tests: 0 | Needs_better_patch: 0
----------------------------------------------------------------+-----------

Changes (by anonymous):

* cc: jdu...@gmail.com (added)

Comment:



--
Ticket URL: <http://code.djangoproject.com/ticket/3285#comment:8>

[Django Code]

#3285: [patch] django.contrib.signed_cookies proposal
----------------------------------------------------------------+-----------
Reporter: Marty Alchin (Gulopine) <gulo...@gamemusic.org> | Owner: adrian
Status: reopened | Component: Contrib apps
Version: | Resolution:
Keywords: | Stage: Design decision needed
Has_patch: 1 | Needs_docs: 0
Needs_tests: 0 | Needs_better_patch: 0
----------------------------------------------------------------+-----------

Changes (by Gary Wilson <gary....@gmail.com>):

* cc: gary....@gmail.com (added)

Comment:



--
Ticket URL: <http://code.djangoproject.com/ticket/3285#comment:9>

[Django Code]

#3285: Signed cookies

----------------------------------------------------------------+-----------
Reporter: Marty Alchin (Gulopine) <gulo...@gamemusic.org> | Owner: adrian
Status: reopened | Component: Contrib apps
Version: | Resolution:

Keywords: signed cookies | Stage: Design decision needed

Has_patch: 1 | Needs_docs: 0
Needs_tests: 0 | Needs_better_patch: 0
----------------------------------------------------------------+-----------

Changes (by Marty Alchin <gulo...@gamemusic.org>):

* keywords: => signed cookies
* summary: [patch] django.contrib.signed_cookies proposal => Signed
cookies

Comment:

This new unified diff includes non-middleware cookie signing, proper tests
and full documentation.

--
Ticket URL: <http://code.djangoproject.com/ticket/3285#comment:10>

[Django Code]

#3285: Signed cookies
----------------------------------------------------------------+-----------
Reporter: Marty Alchin (Gulopine) <gulo...@gamemusic.org> | Owner: adrian
Status: reopened | Component: Contrib apps
Version: | Resolution:
Keywords: signed cookies | Stage: Design decision needed
Has_patch: 1 | Needs_docs: 0
Needs_tests: 0 | Needs_better_patch: 0
----------------------------------------------------------------+-----------

Comment (by Marty Alchin <gulo...@gamemusic.org>):

I've created a [http://code.google.com/p/django-signedcookies/ Google Code
project] for this, as recommended by django-developers.

--
Ticket URL: <http://code.djangoproject.com/ticket/3285#comment:11>