Skip to content

Add signing of cache values.#60

Open
Varbin wants to merge 11 commits intopallets-eco:mainfrom
Varbin:1-signing
Open

Add signing of cache values.#60
Varbin wants to merge 11 commits intopallets-eco:mainfrom
Varbin:1-signing

Conversation

@Varbin
Copy link

@Varbin Varbin commented Aug 13, 2021

This PR adds the ability to sign the stored cache values. Most classes now accept the extra argument secret_key for signing cache values with this key. itsdangerous is used for signing.

The "SimpleCache" and "MemcachedCache" classes do not accept the new secret_key kwarg - the simple does not have any use, and various memcached client libraries already use pickle internally for serialization.

Checklist:

  • Add tests that demonstrate the correct behavior of the change. Tests should fail without the change.
  • Add or update relevant docs, in the docs folder and in code.
  • Add an entry in CHANGES.rst summarizing the change and linking to the issue.
  • Add .. versionchanged:: entries in any relevant code docs.
  • Run pre-commit hooks and fix any issues.
  • Run pytest and tox, no tests failed. --> let's see what CI/CD say. I unfortunately did not have redis, uwsgi and memcached installed...

setup.cfg Outdated
include_package_data = true
python_requires = >= 3.6
install_requires =
itsdangerous ~= 2.0.0

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this also rejects 2.1 even though that's not expected to contain breaking changes. I'd use ~= 2.0 to allow anything <3...

Copy link
Author

@Varbin Varbin Aug 13, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

):
self.default_timeout = default_timeout
if secret_key is not None:
self.__signed_serializer = itsdangerous.Serializer(

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why double-underscore names? That makes subclassing less convenient.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Subclass are only supposed to access _dump/load(s), but sure, I can remove a single underscore.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants