5 ms·
I would love to switch the default to JSON but people store too much stuff in their sessions that does not work on top of JSON (datetime objects and token objec
by the_mitsuhiko 14y ago
I would love to switch the default to JSON but people store too much stuff in their sessions that does not work on top of JSON (datetime objects and token objects are the most common offender).
In fact the python-openid extension is the most common offender. Also I can't just switch the default because it would invalidate everyone's currently issued sessions.
The issue is not new, changing it without breaking things is the hard part.
- seunosewa 14y agoIt's a security issue. You're allowed to break things (or at least deprecate dangerous features)!
- the_mitsuhiko 14y agoIt's a security issue if people leak their secret key. At that point you have a huge problem anyways. Also breaking things assumes that afterwards you are left with an equally functioning system which I currently don't think I can guarantee.
- phleet 14y agoWhy can't a custom JSON encoder be used with support for serializing/deserializing datetime objects?
- the_mitsuhiko 14y agoIt's still inline signalling and might conflict with what people have. Keep in mind that sessions are schemaless. It's not a huge problem changing that and I have a somewhat working implementation but it will break stuff, that's just how it works unfortunately.
- moe 14y agoOne thing that you could and should add is AES-encryption. It does nothing for the pickle issue but it's quite a shame to send cookies in plain-text in this day and age.