liqd/adhocracy — pull request #349 by skoenen (2013-04-24 09:22:57+00:00)
Title: Adhocracy session middleware without crypto

This request tries to remove the `Beaker` dependency for the session
management.

The new `Session` and the corresponding `SessionMiddleware` can be configured
to use with:

`adhocracy.session_implementation = rest`

The `rest` keyword for this session middleware follows from the concept, that
all session data is stored as a cookie on the client site.

To ensure security for the data stored, the `Session` uses a precoded
`ValueConverter`, for that an alternative could be provided at `Session`
instantiation in the `SessionMiddleware` (_For that it has to be coded there_)

The `ValueConverter` should be (at the moment) one of the following:

* `PlainValueConverter` => Saving values as plain text without further
security
* `SignedValueConverter` => Saving values as plain text and adding a
signature, that is produced with a secret. Also add the uses hash algorithm
to the cookie for later transistion to new hash algorithm. (thx @phihag for
that idea)

`CryptValueConverter` is not part of this request.
_There is another branch with the `CryptValueConverter`
[@skoenen/adhocracy/adhocracy\_session\_middleware]
(https://github.com/skoenen/adhocracy/tree/adhocracy_session_middleware)
with a pullrequest [@liqd/adhocracy/pull/#]
(https://github.com/liqd/adhocracy/pull/)_

The implementation uses the `pylons.session` to make the session known in the
current request context.