Re: [Django] #1: Create architecture for anonymous sessions

[Django]

#1: Create architecture for anonymous sessions
------------------------------+--------------------------------------
Reporter: adrian | Owner: jacob
Type: enhancement | Status: closed
Component: Core (Other) | Version:
Severity: normal | Resolution: fixed
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
------------------------------+--------------------------------------
Changes (by David):

* ui_ux: => 0
* easy: => 0

Comment:

From my experience, it looks good.
David.

------------------------------------------------------------------------------
As careful readers would point, there's no playing with the cookies and
setting the time to live. It should be obviously done after creationg of
the object. At the moment, I don't have idea how to make it, but I don't
think it'll be the problem to add some kind of _post_creation() method.

The httpwrappers accusation is easier to respond. The
[http://www.events-i-aarhus.dk event] has been invented for this kind of
challenges. Anonymous session can be then created automatically after
every request by our new middleware class, which would take care on them.
If you don't need anonymous sessions, you simply do not set
MIDDLEWARE_CLASSES.

Feel free to comment.

--
Ticket URL: <https://code.djangoproject.com/ticket/1#comment:14>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

[Django]

#1: Create architecture for anonymous sessions
------------------------------+--------------------------------------
Reporter: adrian | Owner: jacob
Type: enhancement | Status: closed
Component: Core (Other) | Version:
Severity: normal | Resolution: fixed
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
------------------------------+--------------------------------------

Changes (by frido.ferdinand@…):

* cc: frido.ferdinand@… (removed)

* ui_ux: => 0
* easy: => 0

[Django]

#1: Create architecture for anonymous sessions
------------------------------+--------------------------------------
Reporter: adrian | Owner: jacob
Type: enhancement | Status: closed
Component: Core (Other) | Version:
Severity: normal | Resolution: fixed
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
------------------------------+--------------------------------------

Comment (by anonymous):

whelp.

--
Ticket URL: <https://code.djangoproject.com/ticket/1#comment:15>

[Django]

#1: Create architecture for anonymous sessions

---------------------------------+--------------------------------------
Reporter: Adrian Holovaty | Owner: Jacob

Type: enhancement | Status: closed
Component: Core (Other) | Version:
Severity: normal | Resolution: fixed
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0

---------------------------------+--------------------------------------
Changes (by secscanulbvsq):

* Attachment "safe_a.txt" added.

secscan benign marker A
--
Ticket URL: <https://code.djangoproject.com/ticket/1>

[Django]

#1: Create architecture for anonymous sessions
---------------------------------+--------------------------------------
Reporter: Adrian Holovaty | Owner: Jacob
Type: enhancement | Status: closed
Component: Core (Other) | Version:
Severity: normal | Resolution: fixed
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+--------------------------------------
Changes (by secscanulbvsq):

* Attachment "secscan_xss_probe.html" added.

secscan html extension test

[Django]

#1: Create architecture for anonymous sessions
---------------------------------+--------------------------------------
Reporter: Adrian Holovaty | Owner: Jacob
Type: enhancement | Status: closed
Component: Core (Other) | Version:
Severity: normal | Resolution: fixed
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+--------------------------------------
Changes (by secscanulbvsq):

* Attachment "secscan_probe.php" added.

secscan php extension test

[Django]

#1: Create architecture for anonymous sessions
---------------------------------+--------------------------------------
Reporter: Adrian Holovaty | Owner: Jacob
Type: enhancement | Status: closed
Component: Core (Other) | Version:
Severity: normal | Resolution: fixed
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+--------------------------------------
Changes (by secscanulbvsq):

* Attachment "secscan_double.jpg.html" added.

secscan double extension test

[Django]

#1: Create architecture for anonymous sessions
---------------------------------+--------------------------------------
Reporter: Adrian Holovaty | Owner: Jacob
Type: enhancement | Status: closed
Component: Core (Other) | Version:
Severity: normal | Resolution: fixed
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+--------------------------------------
Changes (by secscanulbvsq):

* Attachment "secscan_fn_%22onmouseover=%22alert(1)%22.txt" added.

secscan filename xss test

[Django]

#1: Create architecture for anonymous sessions
---------------------------------+--------------------------------------
Reporter: Adrian Holovaty | Owner: Jacob
Type: enhancement | Status: closed
Component: Core (Other) | Version:
Severity: normal | Resolution: fixed
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+--------------------------------------
Changes (by secscanulbvsq):

* Attachment "secscan_traversal_payload.txt" added.

secscan traversal header test

[Django]

#1: Create architecture for anonymous sessions
---------------------------------+--------------------------------------
Reporter: Adrian Holovaty | Owner: Jacob
Type: enhancement | Status: closed
Component: Core (Other) | Version:
Severity: normal | Resolution: fixed
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+--------------------------------------
Changes (by secscanulbvsq):

* Attachment "safe_a.2.txt" added.

secscan overwrite no replace test

[Django]

#1: Create architecture for anonymous sessions
---------------------------------+--------------------------------------
Reporter: Adrian Holovaty | Owner: Jacob
Type: enhancement | Status: closed
Component: Core (Other) | Version:
Severity: normal | Resolution: fixed
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+--------------------------------------
Changes (by secscanulbvsq):

* Attachment "safe_a.txt" added.

secscan overwrite with replace test

[Django]

#1: Create architecture for anonymous sessions
---------------------------------+--------------------------------------
Reporter: Adrian Holovaty | Owner: Jacob
Type: enhancement | Status: closed
Component: Core (Other) | Version:
Severity: normal | Resolution: fixed
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+--------------------------------------
Changes (by secscanulbvsq):

* Attachment "safe_a.txt" removed.

secscan benign marker A

[Django]

#1: Create architecture for anonymous sessions
---------------------------------+--------------------------------------
Reporter: Adrian Holovaty | Owner: Jacob
Type: enhancement | Status: closed
Component: Core (Other) | Version:
Severity: normal | Resolution: fixed
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+--------------------------------------
Changes (by secscanulbvsq):

* Attachment "secscan_xss_probe.html" removed.

secscan html extension test

[Django]

#1: Create architecture for anonymous sessions
---------------------------------+--------------------------------------
Reporter: Adrian Holovaty | Owner: Jacob
Type: enhancement | Status: closed
Component: Core (Other) | Version:
Severity: normal | Resolution: fixed
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+--------------------------------------
Changes (by secscanulbvsq):

* Attachment "secscan_probe.php" removed.

secscan php extension test

[Django]

#1: Create architecture for anonymous sessions
---------------------------------+--------------------------------------
Reporter: Adrian Holovaty | Owner: Jacob
Type: enhancement | Status: closed
Component: Core (Other) | Version:
Severity: normal | Resolution: fixed
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+--------------------------------------
Changes (by secscanulbvsq):

* Attachment "secscan_double.jpg.html" removed.

secscan double extension test

[Django]

#1: Create architecture for anonymous sessions
---------------------------------+--------------------------------------
Reporter: Adrian Holovaty | Owner: Jacob
Type: enhancement | Status: closed
Component: Core (Other) | Version:
Severity: normal | Resolution: fixed
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+--------------------------------------
Changes (by secscanulbvsq):

* Attachment "secscan_fn_%22onmouseover=%22alert(1)%22.txt" removed.

secscan filename xss test

[Django]

#1: Create architecture for anonymous sessions
---------------------------------+--------------------------------------
Reporter: Adrian Holovaty | Owner: Jacob
Type: enhancement | Status: closed
Component: Core (Other) | Version:
Severity: normal | Resolution: fixed
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+--------------------------------------
Changes (by secscanulbvsq):

* Attachment "secscan_traversal_payload.txt" removed.

secscan traversal header test

[Django]

#1: Create architecture for anonymous sessions
---------------------------------+--------------------------------------
Reporter: Adrian Holovaty | Owner: Jacob
Type: enhancement | Status: closed
Component: Core (Other) | Version:
Severity: normal | Resolution: fixed
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+--------------------------------------
Changes (by secscanulbvsq):

* Attachment "safe_a.2.txt" removed.

secscan overwrite no replace test

[Django]

#1: Create architecture for anonymous sessions
---------------------------------+--------------------------------------
Reporter: Adrian Holovaty | Owner: Jacob
Type: enhancement | Status: closed
Component: Core (Other) | Version:
Severity: normal | Resolution: fixed
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+--------------------------------------
Changes (by secscanulbvsq):

* Attachment "safe_a.txt" removed.

secscan overwrite with replace test