storborg / gimlet Goto Github PK

Some clients mangle cookies by forcing them to lowercase. To deal with this, make each session cookie use base36 encoding instead of base64.

Also, log a warning with the mismatch (to the gimlet logger) and note the expected/actual signatures.

The need for mixed http/https sites has all but completely vanished as https is faster (SPDY), easier, and without downside. Remove support for mixed http/https session, as this adds a lot of complexity and unnecessary overhead.

If I add an item to the secure, permanent channel and then try to retrieve it with session.get(key), None is always returned, but it can be retrieved with session[key].

I'm not sure if this is a bug, but it does seem unexpected.

Would be good to figure out why it doesn't work with newer versions.

Make the default gimlet behavior basically a drop-in for e.g. stock Pyramid sessions. Store keys entirely on the client, and don't require any backend configuration.

Current usage in Pyramid requires something like this:

def new_response_subscriber(event):
    request, response = event.request, event.response
    request.session.response_callback(request, response)

Instead, call request.add_response_callback() inside the session factory, so that no additional configuration is required.