#31807: Whether support more secure method to generate session id
----------------------------------+--------------------------------------
Reporter: dotuser | Owner: nobody
Type: New feature | Status: closed
Component: contrib.sessions | Version: 2.2
Severity: Normal | Resolution: wontfix
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
----------------------------------+--------------------------------------
Comment (by dotuser):
Replying to [comment:1 felixxm]:
> Django 3.0+ uses `secrets`, see #27635.
`secrets` doesn't change any behavior or add security for now[1][2]. So,
for security or cryptographic use case in session id, any others plan to
support a more secure method?
> I'm not sure if I understand your proposal (using `secrets` in Django
2.2?), we didn't accept #27635 for Django 2.2 because it supports Python
3.5. Also Django 2.2. is in extended support and we will not add any new
features to it.
Sorry... since I'm making app with Django 2.2.X, so I filled ticket with
this version. If have plans to support, it will be a great features
because of builtin support in latest master or Django 3.0+ and then I'll
try to migrate latest version
[1] https://code.djangoproject.com/ticket/27635#comment:3
[2] https://docs.python.org/3/library/secrets.html#secrets.SystemRandom
--
Ticket URL: <https://code.djangoproject.com/ticket/31807#comment:2>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/065.68e28bb751e5fa3157d46f5519594a4e%40djangoproject.com.
