itsdangerous

https://github.com/pallets/itsdangerous/issues/112 > I’m sorry for the inconvenience caused but I missed that there was a signature change that made it into 1.0. I yanked the release now because this change had some very bad consequences and yanking the release is less risky in comparison. Ugh, why not release 1.0.1 with the change reverted? That would be the right thing to do whether 1.0 were yanked or not.

This is a very common problem in a lot of signed cookie based session stores. Some frameworks get it right, some don't. The best remediation is to include an expire timestamp within the content of the signed cookie and to check this on the server - you can't rely on the client deleting the cookie (never trust the client). The guys at GitHub fixed this particular issue in their rails stack, and submitted a pull request 4 months ago: https://github.com/rails/rails/pull/11168 It started out well, and their proposed solution would have fixed this problem. The thread got bogged down in discussing backwards compatibility and the original submitter just gave up on it. I hope this might trigger somebody to pick that pull request up again and get it sorted and merged. Since signed cookies are now a popular form of persisting session state I have b

It shouldn't be more than changing those two lines: https://github.com/mitsuhiko/itsdangerous/blob/59f3bf7877e21... And the tests, of course.