U
|
ß=®dY7 ã @ sì d dl mZ d dlZd dlZd dlmZ d dlmZ d dlmZ d dl m
|
Z
|
d dl m Z d dl m Z d d
|
lmZ ejrd d lmZ d d lmZmZ G d d deZG dd de eZG dd deZG dd dZe ZG dd deZdS )é )Ú annotationsN)ÚMutableMapping)Údatetime)Útimezone)Ú BadSignature)ÚURLSafeTimedSerializer)Ú CallbackDicté )ÚTaggedJSONSerializer)ÚFlask)ÚRequestÚResponsec @ sD e Zd ZdZeddddZejdddddZd Zd
|
Zd
|
Z d S ) Ú SessionMixinz3Expands a basic dictionary with session attributes.Úbool©Úreturnc C s | dd¡S )z3This reflects the ``'_permanent'`` key in the dict.Ú
|
_permanentF)Úget©Úself© r úEd:\z\workplace\vscode\pyvenv\venv\Lib\site-packages\flask/sessions.pyÚ permanent s zSessionMixin.permanentÚNone)Úvaluer c C s t || d< d S )Nr )r )r r r r r r s FTN)
|
Ú__name__Ú
|
__module__Ú __qualname__Ú__doc__Úpropertyr ÚsetterÚnewÚmodifiedÚaccessedr r r r r s r c sv e Zd ZdZdZdZdddd fdd Zd dd
|
fd d Zdd ddd fdd Zdd ddd fdd Z Z
|
S )ÚSecureCookieSessiona Base class for sessions based on signed cookies.
|
|
This session backend will set the :attr:`modified` and
|
:attr:`accessed` attributes. It cannot reliably track whether a
|
session is new (vs. empty), so :attr:`new` remains hard coded to
|
``False``.
|
FNút.Anyr )Úinitialr c s dddd}t ||¡ d S )Nr r c S s d| _ d| _d S ©NT)r" r# r r r r Ú on_updateG s z/SecureCookieSession.__init__.<locals>.on_update)ÚsuperÚ__init__)r r& r( ©Ú __class__r r r* F s z SecureCookieSession.__init__Ústr)Úkeyr c s d| _ t |¡S r' )r# r) Ú __getitem__)r r. r+ r r r/ M s z SecureCookieSession.__getitem__)r. Údefaultr c s d| _ t ||¡S r' )r# r) r ©r r. r0 r+ r r r Q s zSecureCookieSession.getc s d| _ t ||¡S r' )r# r) Ú
|
setdefaultr1 r+ r r r2 U s z SecureCookieSession.setdefault)N)N)N) r r r r r" r# r* r/ r r2 Ú __classcell__r r r+ r r$ 0 s r$ c @ s@ e Zd ZdZddddddZe Z Z Z Z Z Z
|
Z [dS )Ú NullSessionz¤Class used to generate nicer error messages if sessions are not
|
available. Will still allow read-only access to the empty session
|
but fail on setting.
|
r% z
|
t.NoReturn)ÚargsÚkwargsr c O s t dd S )NzThe session is unavailable because no secret key was set. Set the secret_key on the application to something unique and secret.)Ú RuntimeError)r r5 r6 r r r Ú_fail` s ÿzNullSession._failN) r r r r r8 Ú __setitem__Ú __delitem__ÚclearÚpopÚpopitemÚupdater2 r r r r r4 Z s r4 c @ sâ e Zd ZdZeZdZdddddZdd d
|
d d Zdd dddZ dddddZ
|
dd dddZ dd dddZ dd dddZ dd dddZddd d d d Zddd d d d!Zdd"d#d$d%d&Zddd'd(d)d*d+Zd,S )-ÚSessionInterfacea4 The basic interface you have to implement in order to replace the
|
default session interface which uses werkzeug's securecookie
|
implementation. The only methods you have to implement are
|
:meth:`open_session` and :meth:`save_session`, the others have
|
useful defaults which you don't need to change.
|
|
The session object returned by the :meth:`open_session` method has to
|
provide a dictionary like interface plus the properties and methods
|
from the :class:`SessionMixin`. We recommend just subclassing a dict
|
and adding that mixin::
|
|
class Session(dict, SessionMixin):
|
pass
|
|
If :meth:`open_session` returns ``None`` Flask will call into
|
:meth:`make_null_session` to create a session that acts as replacement
|
if the session support cannot work because some requirement is not
|
fulfilled. The default :class:`NullSession` class that is created
|
will complain that the secret key was not set.
|
|
To replace the session interface on an application all you have to do
|
is to assign :attr:`flask.Flask.session_interface`::
|
|
app = Flask(__name__)
|
app.session_interface = MySessionInterface()
|
|
Multiple requests with the same session may be sent and handled
|
concurrently. When implementing a new session interface, consider
|
whether reads or writes to the backing store must be synchronized.
|
There is no guarantee on the order in which the session for each
|
request is opened or saved, it will occur in the order that requests
|
begin and end processing.
|
|
.. versionadded:: 0.8
|
Fr r4 ©Úappr c C s | ¡ S )aÉ Creates a null session which acts as a replacement object if the
|
real session support could not be loaded due to a configuration
|
error. This mainly aids the user experience because the job of the
|
null session is to still support lookup without complaining but
|
modifications are answered with a helpful error message of what
|
failed.
|
|
This creates an instance of :attr:`null_session_class` by default.
|
)Únull_session_class©r rA r r r Úmake_null_session s
|
z"SessionInterface.make_null_sessionÚobjectr )Úobjr c C s t || jS )zÊChecks if a given object is a null session. Null sessions are
|
not asked to be saved.
|
|
This checks if the object is an instance of :attr:`null_session_class`
|
by default.
|
)Ú
|
isinstancerB )r rF r r r Úis_null_session© s z SessionInterface.is_null_sessionr- c C s
|
|j d S )zJThe name of the session cookie. Uses``app.config["SESSION_COOKIE_NAME"]``.ZSESSION_COOKIE_NAME©ÚconfigrC r r r Úget_cookie_name² s z SessionInterface.get_cookie_namez
|
str | Nonec C s |j d }|r|S dS )a The value of the ``Domain`` parameter on the session cookie. If not set,
|
browsers will only send the cookie to the exact domain it was set from.
|
Otherwise, they will send it to any subdomain of the given value as well.
|
|
Uses the :data:`SESSION_COOKIE_DOMAIN` config.
|
|
.. versionchanged:: 2.3
|
Not set by default, does not fall back to ``SERVER_NAME``.
|
ZSESSION_COOKIE_DOMAINNrI )r rA Úrvr r r Úget_cookie_domain¶ s
|
|
z"SessionInterface.get_cookie_domainc C s |j d p|j d S )a Returns the path for which the cookie should be valid. The
|
default implementation uses the value from the ``SESSION_COOKIE_PATH``
|
config var if it's set, and falls back to ``APPLICATION_ROOT`` or
|
uses ``/`` if it's ``None``.
|
ZSESSION_COOKIE_PATHZAPPLICATION_ROOTrI rC r r r Úget_cookie_pathà s z SessionInterface.get_cookie_pathc C s
|
|j d S )z¥Returns True if the session cookie should be httponly. This
|
currently just returns the value of the ``SESSION_COOKIE_HTTPONLY``
|
config var.
|
ZSESSION_COOKIE_HTTPONLYrI rC r r r Úget_cookie_httponlyË s z$SessionInterface.get_cookie_httponlyc C s
|
|j d S )zReturns True if the cookie should be secure. This currently
|
just returns the value of the ``SESSION_COOKIE_SECURE`` setting.
|
ZSESSION_COOKIE_SECURErI rC r r r Úget_cookie_secureÒ s z"SessionInterface.get_cookie_securec C s
|
|j d S )zÄReturn ``'Strict'`` or ``'Lax'`` if the cookie should use the
|
``SameSite`` attribute. This currently just returns the value of
|
the :data:`SESSION_COOKIE_SAMESITE` setting.
|
ZSESSION_COOKIE_SAMESITErI rC r r r Úget_cookie_samesiteØ s z$SessionInterface.get_cookie_samesiter zdatetime | None)rA Úsessionr c C s |j rt tj¡|j S dS )a A helper method that returns an expiration date for the session
|
or ``None`` if the session is linked to the browser session. The
|
default implementation returns now + the permanent session
|
lifetime configured on the application.
|
N)r r Únowr ÚutcÚpermanent_session_lifetime©r rA rR r r r Úget_expiration_timeß s z$SessionInterface.get_expiration_timec C s |j p|jo|jd S )a© Used by session backends to determine if a ``Set-Cookie`` header
|
should be set for this session cookie for this response. If the session
|
has been modified, the cookie is set. If the session is permanent and
|
the ``SESSION_REFRESH_EACH_REQUEST`` config is true, the cookie is
|
always set.
|
|
This check is usually skipped if the session was deleted.
|
|
.. versionadded:: 0.11
|
Z SESSION_REFRESH_EACH_REQUEST)r" r rJ rV r r r Úshould_set_cookieé s ÿz"SessionInterface.should_set_cookier zSessionMixin | None©rA Úrequestr c C s
|
t dS )aã This is called at the beginning of each request, after
|
pushing the request context, before matching the URL.
|
|
This must return an object which implements a dictionary-like
|
interface as well as the :class:`SessionMixin` interface.
|
|
This will return ``None`` to indicate that loading failed in
|
some way that is not immediately an error. The request
|
context will fall back to using :meth:`make_null_session`
|
in this case.
|
N©ÚNotImplementedError)r rA rZ r r r Ú open_sessionù s z SessionInterface.open_sessionr r ©rA rR Úresponser c C s
|
t dS )zÀThis is called at the end of each request, after generating
|
a response, before removing the request context. It is skipped
|
if :meth:`is_null_session` returns ``True``.
|
Nr[ )r rA rR r_ r r r Ú save_session s z SessionInterface.save_sessionN)r r r r r4 rB Z pickle_basedrD rH rK rM rN rO rP rQ rW rX r] r` r r r r r? k s (
|
r? c @ s` e Zd ZdZdZeejZdZ e
|
Z e Z dddddZdd d
|
d d d ZdddddddZdS )Ú SecureCookieSessionInterfacezuThe default session interface that stores sessions in signed cookies
|
through the :mod:`itsdangerous` module.
|
zcookie-sessionÚhmacr z URLSafeTimedSerializer | Noner@ c C s0 |j s
|
d S t| j| jd}t|j | j| j|dS )N)Úkey_derivationÚ digest_method)ÚsaltÚ
|
serializerÚ signer_kwargs)Z
|
secret_keyÚdictrc rd r re rf )r rA rg r r r Úget_signing_serializer' s ÿüz3SecureCookieSessionInterface.get_signing_serializerr zSecureCookieSession | NonerY c C s~ | |¡}|d krd S |j | |¡¡}|s4| ¡ S t|j ¡ }z|j||d}| |¡W S t k
|
rx | ¡ Y S X d S )N)Úmax_age)
|
ri Úcookiesr rK Ú session_classÚintrU Ú total_secondsÚloadsr )r rA rZ ÚsÚvalrj Údatar r r r] 4 s
|
z)SecureCookieSessionInterface.open_sessionr r r r^ c
|
C sØ | |¡}| |¡}| |¡}| |¡}| |¡}| |¡} |jrN|j d¡ |s~|j rz|j
|
|||||| d |j d¡ d S | ||¡sd S | ||¡}
|
| |¡ t|¡} |j|| |
|
| ||||d |j d¡ d S )NÚCookie)ÚdomainÚpathÚsecureÚsamesiteÚhttponly)Úexpiresrx rt ru rv rw )rK rM rN rP rQ rO r# ÚvaryÚaddr" Z delete_cookierX rW ri Údumpsrh Ú
|
set_cookie) r rA rR r_ Únamert ru rv rw rx ry rq r r r r` B sF
|
|
|
|
|
|
ú ø
|
z)SecureCookieSessionInterface.save_sessionN)r r r r re Ú staticmethodÚhashlibÚsha1rd rc Úsession_json_serializerrf r$ rl ri r] r` r r r r ra s
|
ra ) Ú
|
__future__r r ÚtypingÚtÚcollections.abcr r r Z itsdangerousr r Zwerkzeug.datastructuresr Zjson.tagr
|
Ú TYPE_CHECKINGrA r Úwrappersr r r r$ r4 r? r ra r r r r Ú<module> s& * '
|
