This is mixed with the application class to sign or modify pickles before sending them to the browser and to undo and check that modification on the return trip. When processing modified pickles returned from the browser the class discards pickles which do not pass the security check.
There is only one mixin supplied for this function; the PickleSignMixin class. Pickle strings are combined with the secret string which was passed to the application constructor as the secret argument using the HMAC-SHA1 algorithm. The resulting signature is then prepended to the pickle. On the return trip the HMAC-SHA1 sign is compared with the result of the signing process on the pickle returned from the browser. If the two signs are not the same, the pickle is discarded.
The process does not prevent users from seeing the contents of a pickle, rather it provides an assurance of its authenticity.
The mixin has the following interface.
secret) |
The secret argument is the secret key which is combined with the pickle to produces the HMAC-SHA1 signature.
text) |
text) |