News for hackers. Stuff that matters.

A comment on Ask Hacker News: What Python web framework should I use?. Parent comment

Re:Ask Hacker News: What Python web framework should I use? by bayareaguy on Tuesday March 04, 2008 @06:34PM (#129282)
For a second I didn't get what the big deal was here. Sure you have to keep your pickled python objects in a secure place on your server. Sure you could have problems if someone could get at those, but they would need to crack your server first and then figure out how your app worked. If they could do that you're hosed anyway...

Then it hit me.

He was suggesting you give the pickled object back to the client in the session cookie and load whatever the client sends later right back into the interpreter. Whee!

[ Parent | on HN ]
Re:Ask Hacker News: What Python web framework should I use? by icky on Thursday March 06, 2008 @12:30AM (#130344)
> He was suggesting you give the pickled object back to the client in the session cookie and load whatever the client sends later right back into the interpreter. Whee!

I've done that with signed cookies.

[ Parent | on HN ]
Re:Ask Hacker News: What Python web framework should I use? by bayareaguy on Thursday March 06, 2008 @04:07PM (#130825)
I imagine you didn't store any per-session state on the server as well, so I'm curious about what you used to validate the cookie.
[ Parent | on HN ]
Re:Ask Hacker News: What Python web framework should I use? by icky on Thursday March 06, 2008 @09:23PM (#130992)
I secretly salted the cookie.

Think HMAC, though I used two completely different keys, rather than generating them from one key, added an optional step of appending the client's IP address after the first hashing (with the first key) and before the second one.

(The second hashing in HMAC is designed to prevent collision attacks (even on weak algorithms like MD5), since you'd essentially have to find a fraudulent input that collides twice: once when hashed, and once more when its hash is hashed).

My implementation also allowed the data to span an arbitrary number of ~4kb cookies). Firefox maxed out at around 0.5MB, though if you're using that much session data, you may want to rethink your app design... ;)

[ Parent | on HN ]
Re:Ask Hacker News: What Python web framework should I use? by inklesspen on Thursday March 06, 2008 @09:50AM (#130564)
There wasn't any encryption involved in his suggestion. :D
[ Parent | on HN ]