linsomniac / bottlesession Goto Github PK

sessionid = bottle.request.COOKIES.get('sessionid')

should be

sessionid = bottle.request.get_cookie('sessionid')

Hi

After using some time i get following error :"ValueError: Unable to allocate unique session". Have to clean and restart the server or to clean the Browser cache:

Traceback (most recent call last):
File "/home/config/WEBGUI5/bottle.py", line 872, in _handle
return route.call(*_args)
File "/home/config/WEBGUI5/bottle.py", line 1755, in wrapper
rv = callback(_a, **ka)
File "index.py", line 475, in do_login
session = session_manager.get_session()
File "/home/config/WEBGUI5/bottlesession.py", line 117, in get_session
sessionid = self.allocate_new_session_id()
File "/home/config/WEBGUI5/bottlesession.py", line 111, in allocate_new_session_id
raise ValueError('Unable to allocate unique session')
ValueError: Unable to allocate unique session

It seems in my environment(bottle version:0.11.6), cookie expires is set with an absolute timestamp, while bottlesession still use a relative time. This will create a cookie expires at 1970-xx-xx which finally cause an infinity redirection loop (login->auth(failed because cookie expires)->login-> ...)

os.umask(077) does not work in python 3
os.umask('077') works with both 2 and 3.

uuid1, /proc/uptime and sha1() are being used to generate a secret.
uuids are not meant to be cryptograpically secure, /proc/uptime is predictable and therefore its sha1()

Please consider using /dev/urandom - it's there for a reason ;)