#32191: Not RFC 6265 compliant cookies in contrib.messages.
----------------------------------+---------------------------------------
Reporter: Nico Giefing | Owner: Craig Smith
Type: Bug | Status: assigned
Component: contrib.messages | Version: 3.1
Severity: Normal | Resolution:
Keywords: Cookie malformed | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
----------------------------------+---------------------------------------
Comment (by Florian Apolloner):
> Anyway, I think the safest and most minimal thing to do is to modify the
messages framework to % url quote cookies as PR 13690 suggests. I don't
have a clear picture for a more general framework-wide fix, but I at least
wanted to write my story down somewhere in case it's helpful.
I kinda agree, but encoding like I suggested introduces quite an overhead.
In that sense I think it would make sense to (if we are changing it
anyways) ensure that we can generate even shorter messages. This is the
reason why I suggested to move `compress` into the signer base classes.
This way the messaging framework could benefit from shorter messages while
automatically ensuring compatibility with the RFC (the created base64 only
contains valid chars).
--
Ticket URL: <https://code.djangoproject.com/ticket/32191#comment:17>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/063.7a6e4ba653fffb73c28c13a9bd768ea2%40djangoproject.com.
