liqd/adhocracy — pull request #350 by skoenen (2013-04-24 09:23:44+00:00)
Title: Adhocracy session middleware

This request tries to remove the `Beaker` dependency for the session
management.

The new `Session` and the corresponding `SessionMiddleware` can be configured
to use with:

`adhocracy.session_implementation = rest`

The `rest` keyword for this session middleware follows from the concept, that
all session data is stored as a cookie on the client site.

To ensure security for the data stored, the `Session` uses a precoded
`ValueConverter`, for that an alternative could be provided at `Session`
instantiation in the `SessionMiddleware` (_For that it has to be coded there_)

The `ValueConverter` should be (at the moment) one of the following:

* `PlainValueConverter` => Saving values as plain text without further
security
* `SignedValueConverter` => Saving values as plain text and adding a
signature, that is produced with a secret. Also add the uses hash algorithm
to the cookie for later transistion to new hash algorithm. (thx @phihag for
that idea)
* `CryptValueConverter` => Saving values crypted with `AES 256, 192, 128`
(Depending on the secret length **32**, **24** or **8** character, secrets
that has not the correct length are hashed an the first 32 character are
used for the key, results in enforcing AES 256), and salted the value with
the secret ( _could maybe need to change that to time of day or so_ ).
This `CryptValueConverter` leads to the `pycrypto >= 2.6` dependency.
_There is another branch without the `CryptValueConverter`
[@skoenen/adhocracy/adhocracy\_session\_middleware\_without\_crypto]
(https://github.com/skoenen/adhocracy/tree/adhocracy_session_middleware_without_crypto)
with a pullrequest [@liqd/adhocracy/pull/#349]
(https://github.com/liqd/adhocracy/pull/349)_

The implementation uses the `pylons.session` to make the session known in the
current request context.