webob.cookies -- Cookies¶
Cookies¶
A helper class that helps bring some sanity to the insanity that is cookie handling.
The helper is capable of generating multiple cookies if necessary to support subdomains and parent domains.
cookie_nameThe name of the cookie used for sessioning. Default:
'session'.max_ageThe maximum age of the cookie used for sessioning (in seconds). Default:
None(browser scope).secureThe 'secure' flag of the session cookie. Default:
False.httponlyHide the cookie from Javascript by setting the 'HttpOnly' flag of the session cookie. Default:
False.samesiteThe 'SameSite' attribute of the cookie, can be either
b"Strict",b"Lax", orNone.pathThe path used for the session cookie. Default:
'/'.domainsThe domain(s) used for the session cookie. Default:
None(no domain). Can be passed an iterable containing multiple domains, this will set multiple cookies one for each domain.serializerAn object with two methods:
loadsanddumps. Theloadsmethod should accept a bytestring and return a Python object. Thedumpsmethod should accept a Python object and return bytes. AValueErrorshould be raised for malformed inputs. Default:None, which will use a derivation ofjson.dumps()andjson.loads().
Bind a request to a copy of this instance and return it
Looks for a cookie by name in the currently bound request, and returns its value. If the cookie profile is not bound to a request, this method will raise a
ValueError.Looks for the cookie in the cookies jar, and if it can find it it will attempt to deserialize it. Returns
Noneif there is no cookie or if the value in the cookie cannot be successfully deserialized.
Set the cookies on a response.
Retrieve raw headers for setting cookies.
Returns a list of headers that should be set for the cookies to be correctly tracked.
A helper for generating cookies that are signed to prevent tampering.
By default this will create a single cookie, given a value it will serialize it, then use HMAC to cryptographically sign the data. Finally the result is base64-encoded for transport. This way a remote user can not tamper with the value without uncovering the secret/salt used.
secretA string which is used to sign the cookie. The secret should be at least as long as the block size of the selected hash algorithm. For
sha512this would mean a 512 bit (64 character) secret.saltA namespace to avoid collisions between different uses of a shared secret.
hashalgThe HMAC digest algorithm to use for signing. The algorithm must be supported by the
hashliblibrary. Default:'sha512'.cookie_nameThe name of the cookie used for sessioning. Default:
'session'.max_ageThe maximum age of the cookie used for sessioning (in seconds). Default:
None(browser scope).secureThe 'secure' flag of the session cookie. Default:
False.httponlyHide the cookie from Javascript by setting the 'HttpOnly' flag of the session cookie. Default:
False.samesiteThe 'SameSite' attribute of the cookie, can be either
b"Strict",b"Lax", orNone.pathThe path used for the session cookie. Default:
'/'.domainsThe domain(s) used for the session cookie. Default:
None(no domain). Can be passed an iterable containing multiple domains, this will set multiple cookies one for each domain.serializerAn object with two methods: loads` and
dumps. Theloadsmethod should accept bytes and return a Python object. Thedumpsmethod should accept a Python object and return bytes. AValueErrorshould be raised for malformed inputs. Default:None`, which will use a derivation of :func:`json.dumps` and ``json.loads.
Bind a request to a copy of this instance and return it
A helper to cryptographically sign arbitrary content using HMAC.
The serializer accepts arbitrary functions for performing the actual serialization and deserialization.
secretA string which is used to sign the cookie. The secret should be at least as long as the block size of the selected hash algorithm. For
sha512this would mean a 512 bit (64 character) secret.saltA namespace to avoid collisions between different uses of a shared secret.
hashalgThe HMAC digest algorithm to use for signing. The algorithm must be supported by the
hashliblibrary. Default:'sha512'.serializerAn object with two methods: loads` and
dumps. Theloadsmethod should accept bytes and return a Python object. Thedumpsmethod should accept a Python object and return bytes. AValueErrorshould be raised for malformed inputs. Default:None`, which will use a derivation of :func:`json.dumps` and ``json.loads.
Given an
appstruct, serialize and sign the data.Returns a bytestring.
Given a
bstruct(a bytestring), verify the signature and then deserialize and return the deserialized value.A
ValueErrorwill be raised if the signature fails to validate.
A serializer which uses json.dumps` and
json.loads
Generate a cookie value.
nameThe name of the cookie.
valueThe
valueof the cookie. If it isNone, it will generate a cookie value with an expiration date in the past.max_ageThe maximum age of the cookie used for sessioning (in seconds). Default:
None(browser scope).pathThe path used for the session cookie. Default:
/.domainThe domain used for the session cookie. Default:
None(no domain).secureThe 'secure' flag of the session cookie. Default:
False.httponlyHide the cookie from JavaScript by setting the 'HttpOnly' flag of the session cookie. Default:
False.commentSet a comment on the cookie. Default:
NonesamesiteThe 'SameSite' attribute of the cookie, can be either
"Strict","Lax", orNone.