This is mixed with the application class to sign or modify pickles before sending them to the browser and to undo and check that modification on the return trip. When processing modified pickles returned from the browser the class discards pickles which do not pass the security check.
There is only one mixin supplied for this function; the PickleSignMixin class. Pickle strings are combined with the secret string which was passed to the application constructor as the secret argument. The MD5 sign for the combined string is then prepended to the pickle. On the return trip the MD5 sign is removed compared with the result of the signing process on the pickle returned from the browser. If the two signs are not the same, the pickle is discarded.
The process does not prevent users from seeing the contents of a pickle. Assuming that you keep your secret, to modify the pickle a user must be able to crack the 128 bit MD5 sign.
The mixin has the following interface.
secret) |
The secret argument is the secret which is used to protect the MD5 sign.
text) |
text) |