Pylons/pyramid — pull request #1142 by mmerickel (2013-10-05 21:44:20+00:00)
Title: signed cookie session api

I'd like to add docs before merging this but I wanted to get it some review first.

Goals of this PR:

- Break core of `UnencryptedCookieSessionFactoryConfig` out into a
`BaseCookieSessionFactory`.

- Add support for `reissue_time`. Set the unencrypted class to
use `reissue_time=0` for bw-compat.

- Add `SignedCookieSessionFactory` which wraps the base in a serializer
that uses signing via a sha512+hmac with a secret derived using an
8-byte random salt.

The goal would be to allow random implementers to use a robust cookie session object as their starting point. Something that conforms to `ISession` as well as supporting changed/invalidate tracking on its properties.

Also the poorly named `UnencryptedCookieSessionFactoryConfig` can be deprecated in favor of an improved `SignedCookieSessionFactory`.