orbit-oss/flask
4
4
Fork 2
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

enable secret key rotation

Browse source
This commit is contained in:
David Lord 2024-11-08 08:09:01 -08:00
parent 7522c4bcdb
commit e13373f838
No known key found for this signature in database
GPG key ID: 43368A7AA8CC5926
9 changed files with 55 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

1
src/flask/app.py
View file

@ -180,6 +180,7 @@ class Flask(App):
"TESTING": False,
"PROPAGATE_EXCEPTIONS": None,
"SECRET_KEY": None,
"SECRET_KEY_FALLBACKS": None,
"PERMANENT_SESSION_LIFETIME": timedelta(days=31),
"USE_X_SENDFILE": False,
"SERVER_NAME": None,

16
src/flask/sessions.py
View file

@ -315,14 +315,20 @@ class SecureCookieSessionInterface(SessionInterface):
def get_signing_serializer(self, app: Flask) -> URLSafeTimedSerializer | None:
if not app.secret_key:
return None
signer_kwargs = dict(
key_derivation=self.key_derivation, digest_method=self.digest_method
)
keys: list[str | bytes] = [app.secret_key]
if fallbacks := app.config["SECRET_KEY_FALLBACKS"]:
keys.extend(fallbacks)
return URLSafeTimedSerializer(
app.secret_key,
keys, # type: ignore[arg-type]
salt=self.salt,
serializer=self.serializer,
signer_kwargs=signer_kwargs,
signer_kwargs={
"key_derivation": self.key_derivation,
"digest_method": self.digest_method,
},
)
def open_session(self, app: Flask, request: Request) -> SecureCookieSession | None: