diff options
| -rw-r--r-- | docs/api/session.rst | 2 | ||||
| -rw-r--r-- | docs/narr/sessions.rst | 21 | ||||
| -rw-r--r-- | pyramid/session.py | 8 | ||||
| -rw-r--r-- | pyramid/tests/test_session.py | 6 |
4 files changed, 18 insertions, 19 deletions
diff --git a/docs/api/session.rst b/docs/api/session.rst index 12b727183..44b4bd860 100644 --- a/docs/api/session.rst +++ b/docs/api/session.rst @@ -5,7 +5,7 @@ .. automodule:: pyramid.session - .. autofunction:: InsecureCookieSessionFactoryConfig + .. autofunction:: UnencryptedCookieSessionFactoryConfig .. autofunction:: signed_serialize diff --git a/docs/narr/sessions.rst b/docs/narr/sessions.rst index f27669738..43cb78410 100644 --- a/docs/narr/sessions.rst +++ b/docs/narr/sessions.rst @@ -40,8 +40,8 @@ application by using the ``session_factory`` argument to the .. code-block:: python :linenos: - from pyramid.session import InsecureCookieSessionFactoryConfig - my_session_factory = InsecureCookieSessionFactoryConfig('itsaseekreet') + from pyramid.session import UnencryptedCookieSessionFactoryConfig + my_session_factory = UnencryptedCookieSessionFactoryConfig('itsaseekreet') from pyramid.configuration import Configurator config = Configurator(session_factory = my_session_factory) @@ -49,15 +49,14 @@ application by using the ``session_factory`` argument to the .. warning:: Note the very long, very explicit name for - ``InsecureCookieSessionFactoryConfig``. It's trying to tell you - that this implementation is, by default, *insecure*. You should - not use it when you keep sensitive information in the session - object, as the information can be easily read by both users of your - application and third parties who have access to your users' - network traffic. Use a different session factory implementation - (preferably one which keeps session data on the server) for - anything but the most basic of applications where "session security - doesn't matter". + ``UnencryptedCookieSessionFactoryConfig``. It's trying to tell you that + this implementation is, by default, *unencrypted*. You should not use it + when you keep sensitive information in the session object, as the + information can be easily read by both users of your application and third + parties who have access to your users' network traffic. Use a different + session factory implementation (preferably one which keeps session data on + the server) for anything but the most basic of applications where "session + security doesn't matter". Using a Session Object ---------------------- diff --git a/pyramid/session.py b/pyramid/session.py index 2906bba15..bbb08622a 100644 --- a/pyramid/session.py +++ b/pyramid/session.py @@ -34,7 +34,7 @@ def manage_accessed(wrapped): accessed.__doc__ = wrapped.__doc__ return accessed -def InsecureCookieSessionFactoryConfig( +def UnencryptedCookieSessionFactoryConfig( secret, timeout=1200, cookie_name='session', @@ -46,7 +46,7 @@ def InsecureCookieSessionFactoryConfig( cookie_on_exception=False, ): """ - Configure a :term:`session factory` which will provide insecure + Configure a :term:`session factory` which will provide unencrypted (but signed) cookie-based sessions. The return value of this function is a :term:`session factory`, which may be provided as the ``session_factory`` argument of a @@ -92,7 +92,7 @@ def InsecureCookieSessionFactoryConfig( """ - class InsecureCookieSessionFactory(dict): + class UnencryptedCookieSessionFactory(dict): """ Dictionary-like session object """ implements(ISession) @@ -202,7 +202,7 @@ def InsecureCookieSessionFactoryConfig( ) return True - return InsecureCookieSessionFactory + return UnencryptedCookieSessionFactory def signed_serialize(data, secret): """ Serialize any pickleable structure (``data``) and sign it diff --git a/pyramid/tests/test_session.py b/pyramid/tests/test_session.py index 4c80cebfa..1be010849 100644 --- a/pyramid/tests/test_session.py +++ b/pyramid/tests/test_session.py @@ -1,10 +1,10 @@ import unittest from pyramid import testing -class TestInsecureCookieSession(unittest.TestCase): +class TestUnencryptedCookieSession(unittest.TestCase): def _makeOne(self, request, **kw): - from pyramid.session import InsecureCookieSessionFactoryConfig - return InsecureCookieSessionFactoryConfig('secret', **kw)(request) + from pyramid.session import UnencryptedCookieSessionFactoryConfig + return UnencryptedCookieSessionFactoryConfig('secret', **kw)(request) def test_ctor_no_cookie(self): request = testing.DummyRequest() |