anomaly / vishnu

Sessions for python WSGI applications

      ___           ___           ___           ___           ___           ___       ___     
     /\  \         /\__\         /\  \         /\__\         /\  \         /\__\     |\__\    
    /::\  \       /::|  |       /::\  \       /::|  |       /::\  \       /:/  /     |:|  |   
   /:/\:\  \     /:|:|  |      /:/\:\  \     /:|:|  |      /:/\:\  \     /:/  /      |:|  |   
  /::\~\:\  \   /:/|:|  |__   /:/  \:\  \   /:/|:|__|__   /::\~\:\  \   /:/  /       |:|__|__ 
 /:/\:\ \:\__\ /:/ |:| /\__\ /:/__/ \:\__\ /:/ |::::\__\ /:/\:\ \:\__\ /:/__/        /::::\__\
 \/__\:\/:/  / \/__|:|/:/  / \:\  \ /:/  / \/__/~~/:/  / \/__\:\/:/  / \:\  \       /:/~~/~   
      \::/  /      |:/:/  /   \:\  /:/  /        /:/  /       \::/  /   \:\  \     /:/  /     
      /:/  /       |::/  /     \:\/:/  /        /:/  /        /:/  /     \:\  \    \/__/      
     /:/  /        /:/  /       \::/  /        /:/  /        /:/  /       \:\__\              
     \/__/         \/__/         \/__/         \/__/         \/__/         \/__/              

vishnu's Issues

Add extras_require installs for each backend

• redis
• python-memcached
• pymemcache

Adjust documentation for version 2.0.0

• Remove mentions of it being just for app engine
• New configuration for session
• Multiple backends

add unit test for session timeout setter and getter

Implement sync_only for every session type or make it app engine specific

Break session configuration out of WSGI environ

Add a config for each backend

• GAE NDB
• GAE memache
• python-memcached
• pymemcache
• redis

add configurable cookie name

Google Cloud Datastore backend

add encryption to cookie value

add warning to log if user is trying to send cookie over HTTP with secure=True

This will assist in debugging.

python-memcached does not work on python3

add session expiry/timeout

• Set the Expires setting on the cookie.
• Configurable as default from app.yaml
• Ability to set per session
• Clearable with a constant
• Saved in datastore

add session encrypt

add expired session cleanup

• delete if expired
• delete if no access for x seconds

Initialization failing if timeout parameter provided

add pypy targets for travis

• linux
• osx

Add alternate backends

• Google App Engine NDB gae-ndb
• Google App Engine memcache gae-memcache
• Python memcached python-memcached
• pymemcache
• Redis redis

Consider migrating to pycryptodome

https://github.com/Legrandin/pycryptodome

Move config variables to use WSGI environ instead of os.environ

unit testing for GAE backends

• Middleware
  • GAE NDB
  • GAE memcache
• Backend clients
  • GAE NDB
  • GAE memcache

Add Domain and Path settings

• Path defaults to /
• Path configurable
• Domain default to nothing
• Domain configurable

terminating and starting a session within same request fails to send cookie

Support for pylibmc backend

add auto save support

• load config variable
• save at end of response
• test working

warn if secret/encrypt keys are less than a minimum length

add persistent storage to NDB

Expires field is not being sent down for persisted sessions

session is attempting to save empty data after it has been terminated

unit testing

• Cipher
• Middleware
  • GAE NDB #31
  • GAE memcache #31
  • python-memcached
  • pymemcache
  • redis
• Session config
• Backend configs
  • GAE NDB
  • GAE memcache
  • python-memcached
  • pymemcache
  • redis
• Backend clients
  • GAE NDB #31
  • GAE memcache #31
  • python-memcached
  • pymemcache
  • redis

python3 compatibility

• webapp2 is not compatible with python3 (unit tests), replacing with falcon
• Cookie library has changed
• Python3 version of python-memcached is failing to read pickled session object
• Some imports in vishnu backends were not python compatible
• Pad/unpad method does not work in python3
• Issues with base64 decoding of encrypted cookie data

Avoid timing attacks

https://codahale.com/a-lesson-in-timing-attacks/

Setup basic middleware

Publish to PyPI

Topic :: Internet :: WWW/HTTP :: Session trove categorisation

Move NDB cleanup method into util package

Drop default backend of NDB

Add django support