Python in a Nutshell

Name

SmartCookie

Synopsis

class SmartCookie(input=None)

A SmartCookie instance c is a mapping. c’s keys are strings. c’s values are Morsel instances that wrap arbitrary values serialized with pickle. c [ k ]= v has the semantics:

                           c[k]=Morsel( ); c[k].set(k,str(v),pickle.dumps(v))

Module pickle was covered in Chapter 11. Since you have little control on what code executes during implicit deserialization via pickle.loads, class SmartCookie offers correspondingly little security. Unless your script is exposed only on a trusted intranet, avoid SmartCookie—use SimpleCookie instead. You can use any cryptographic approach to build, and take apart again, the strings wrapped by Morsel instance values in SimpleCookie instances. Modules covered in Chapter 21 make it easy to encode arbitrary byte strings as text strings, quite apart from any cryptographic measures.

SmartCookie is more convenient than SimpleCookie plus cryptography, encoding, and decoding. Convenience and security are often in conflict. The choice is yours. Do not labor under the misapprehension that your system is secure because “after all, nobody knows what I’m doing”: security through obscurity isn’t. Good cryptography is a necessary (but not sufficient) condition for strong security.