Create a new cookie or replace an old one. If the `secret` parameter is set, create a `Signed Cookie` (described below). :param name: the name of the cookie. :param value: the value of the cookie. :param secret: a signature key required for signed co
(self, name, value, secret=None, digestmod=hashlib.sha256, **options)
| 1798 | return default |
| 1799 | |
| 1800 | def set_cookie(self, name, value, secret=None, digestmod=hashlib.sha256, **options): |
| 1801 | """ Create a new cookie or replace an old one. If the `secret` parameter is |
| 1802 | set, create a `Signed Cookie` (described below). |
| 1803 | |
| 1804 | :param name: the name of the cookie. |
| 1805 | :param value: the value of the cookie. |
| 1806 | :param secret: a signature key required for signed cookies. |
| 1807 | |
| 1808 | Additionally, this method accepts all RFC 2109 attributes that are |
| 1809 | supported by :class:`cookie.Morsel`, including: |
| 1810 | |
| 1811 | :param maxage: maximum age in seconds. (default: None) |
| 1812 | :param expires: a datetime object or UNIX timestamp. (default: None) |
| 1813 | :param domain: the domain that is allowed to read the cookie. |
| 1814 | (default: current domain) |
| 1815 | :param path: limits the cookie to a given path (default: current path) |
| 1816 | :param secure: limit the cookie to HTTPS connections (default: off). |
| 1817 | :param httponly: prevents client-side javascript to read this cookie |
| 1818 | (default: off, requires Python 2.6 or newer). |
| 1819 | :param samesite: Control or disable third-party use for this cookie. |
| 1820 | Possible values: `lax`, `strict` or `none` (default). |
| 1821 | |
| 1822 | If neither `expires` nor `maxage` is set (default), the cookie will |
| 1823 | expire at the end of the browser session (as soon as the browser |
| 1824 | window is closed). |
| 1825 | |
| 1826 | Signed cookies may store any pickle-able object and are |
| 1827 | cryptographically signed to prevent manipulation. Keep in mind that |
| 1828 | cookies are limited to 4kb in most browsers. |
| 1829 | |
| 1830 | Warning: Pickle is a potentially dangerous format. If an attacker |
| 1831 | gains access to the secret key, he could forge cookies that execute |
| 1832 | code on server side if unpickled. Using pickle is discouraged and |
| 1833 | support for it will be removed in later versions of bottle. |
| 1834 | |
| 1835 | Warning: Signed cookies are not encrypted (the client can still see |
| 1836 | the content) and not copy-protected (the client can restore an old |
| 1837 | cookie). The main intention is to make pickling and unpickling |
| 1838 | save, not to store secret information at client side. |
| 1839 | """ |
| 1840 | if not self._cookies: |
| 1841 | self._cookies = SimpleCookie() |
| 1842 | |
| 1843 | # Monkey-patch Cookie lib to support 'SameSite' parameter |
| 1844 | # https://tools.ietf.org/html/draft-west-first-party-cookies-07#section-4.1 |
| 1845 | if py < (3, 8, 0): |
| 1846 | Morsel._reserved.setdefault('samesite', 'SameSite') |
| 1847 | |
| 1848 | if secret: |
| 1849 | if not isinstance(value, basestring): |
| 1850 | depr(0, 13, "Pickling of arbitrary objects into cookies is " |
| 1851 | "deprecated.", "Only store strings in cookies. " |
| 1852 | "JSON strings are fine, too.") |
| 1853 | encoded = base64.b64encode(pickle.dumps([name, value], -1)) |
| 1854 | sig = base64.b64encode(hmac.new(tob(secret), encoded, |
| 1855 | digestmod=digestmod).digest()) |
| 1856 | value = touni(tob('!') + sig + tob('?') + encoded) |
| 1857 | elif not isinstance(value, basestring): |
no test coverage detected