#32191: Not RFC 6265 compliant cookies in contrib.messages.
----------------------------------+---------------------------------------
Reporter: Nico Giefing | Owner: Craig Smith
Type: Bug | Status: assigned
Component: contrib.messages | Version: 3.1
Severity: Normal | Resolution:
Keywords: Cookie malformed | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
----------------------------------+---------------------------------------
Comment (by Florian Apolloner):
Hi Craig, I've looked through it and thought a bit about it:
> I have opted to use latin-1 to encode internal to the new functions as
we use latin-1 elsewhere. I was surprised when using utf-8 that a
character was unrecognised
That sounds like a bug to fix. latin-1 encoding will simply not work in
the general case (Try calling `compress_b64` with u'€'). We run messages
through `MessageEncoder` which will result in a JSON string which is
__always__ encodable to `utf-8` (especially since `ensure_ascii` is true).
> Going forward, I will add tests, in particular to confirm RFC6265
compliant message cookies
We also will need tests and a backwards compatibility for old existing
messages.
> and I will attempt integrating the new functions as methods of the
signer base class.
I'd hold off on that now till we figured out the str/bytes/encoding issues
-- we might have fond another hornet nest here :)
--
Ticket URL: <https://code.djangoproject.com/ticket/32191#comment:23>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/063.8bbff4bbfad9eb5e7369004651293cd8%40djangoproject.com.
