#27775: Signed cookies does not support custom expiry
--------------------------------------------+------------------------
Reporter: Andreas Pelme | Owner: nobody
Type: Bug | Status: new
Component: contrib.sessions | Version: 1.10
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 1
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
--------------------------------------------+------------------------
Calling set_expiry() when using the signed cookies backend does not do
anything. This has been known for quite some time, see:
-
https://github.com/django/django/blob/5890d6ab03ebc7dac46ce7d9540b5768785caa34/django/contrib/sessions/backends/signed_cookies.py#L18-L19
- Ticket #19201
Ticket #19201 already exists that goes into details about problems with
session expiration. This ticket exists to track the particular bug that
custom expiration does not work in the signed cookies backend.
I propose that we should either (and I would be happy to work to get PR:s
for):
- Raise an explicit exception when `set_expiry()` is called on signed
cookie session backend. Currently the call is just ignored which may lead
to security issues if the default configured session timeout is very high
and some sensitive login/session need like to have a much lower
expiration.
- Handle expiration in a signed cookies-specific way (see my PR at
https://github.com/django/django/pull/7885 for an attempt at this).
I very much agree with the conclusion in #19201 that expiration is messy
across backends and is in need of refactor but I think the current state
is even worse where we have silent failures for potentially secret
sensitive code.
I don't have the time to work on a full refactor of the expiration (given
that it needs to be very backward compatible it is probably a bit of work
involved).
--
Ticket URL: <https://code.djangoproject.com/ticket/27775>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/048.ee594c616983efee9d693096b13ed835%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
