Signed cookies

[Marty Alchin (Gulopine) <gulopine@…>]

In response to some discussion on Chapter 20 of the Django book, and Jacob's suggestion on django-users (​here), this is a proposal for a contrib app (tentatively called django.contrib.signed_cookies) to implement signed cookies throughout a Django project.

The only setting necessary to activate it is the inclusion of the middleware class to MIDDLEWARE_CLASSES, as it uses the existing SECRET_KEY setting to help generate the signature used to authenticate the cookies. Its position in MIDDLEWARE_CLASSES matters, as it transparently handles the signature encryption, validation and signature removal, so that other middlewares and views don't need to have any knowledge of its presence.

• Each new cookie's name and value is taken along with the site's SECRET_KEY to generate a digest signature
• The signature is then prepended to the cookie's value.
• When a request comes in, it then recalculates the digest and validates it against the signature it contains.
• If the cookie doesn't contain a signature, or if it fails to validate, the cookie is removed from request.COOKIES.
  • In this case, the view would usually reset the cookie, at which point it would be signed properly.
• If all succeeds, the signature is removed from the cookie's value in request.COOKIES.

Currently it uses MD5, but could easily be adapted to use a setting that would control which digest utility is used to generate the signature.

[Marty Alchin <gulopine@…>]

The only file necessary to make it work

[Chris Beaven]

Looks good, Marty! Is there a way to write some tests for this middleware?

I'm going to mark this as "decision needed" and let the core decide on whether this is viable.

[Marty Alchin <gulopine@…>]

Tests for it should be fairly straightforward, I'll get to work on them this weekend.

[Marty Alchin <gulopine@…>]

complete unit test suite

[Marty Alchin <gulopine@…>]

Not that it should matter, but test_delete_cookie in the provided test suite fails in Django 0.95, due to #2503. However, since delete_cookie is only called in the test suite, the middleware itself functions propertly, even in 0.95.

[sh_samira95@…]

Can anybody help me? I have problem by cookies. I want to have two kind of cookie: permanent and temporary. Temporary cookie should be deleted when browser close. I don't want to use "SESSION_EXPIRE_AT_BROWSER_CLOSE" because that will delete all part of cookies but I want to temporary part to delete. Can you know how I shall do that? Can I have two sessions in my code or any event for closing browser exists? I can't use "unload" JavaScript events because that is call when URL is change, in my test the URL will be change page by page, I want to delete temporary cookie whenever browser close.
Thanks a lot

[sh_samira95@…]

Can anybody help me? I have problem by cookies. I want to have two kind of cookie: permanent and temporary. Temporary cookie should be deleted when browser close. I don't want to use "SESSION_EXPIRE_AT_BROWSER_CLOSE" because that will delete all part of cookies but I want to temporary part to delete. Can you know how I shall do that? Can I have two sessions in my code or any event for closing browser exists? I can't use "unload" JavaScript? events because that is call when URL is change, in my test the URL will be change page by page, I want to delete temporary cookie whenever browser close. Thanks a lot

[Michael Radziej <mir@…>]

Please go to the django-users mailing list for user support. Tickets are for bug reports and enhancement requests.

[Marty Alchin <gulopine@…>]

A more complete patch, including documentation

[Marty Alchin <gulopine@…>]

This new unified diff includes non-middleware cookie signing, proper tests and full documentation.

[Marty Alchin <gulopine@…>]

Complete patch again, with corrected documentation

[Marty Alchin <gulopine@…>]

I've created a ​Google Code project for this, as recommended by django-developers.

[Jacob]

Closing this in favor of Marty's exernal project.