Consider using itsdangerous for mail tokens.

[Elrond]

​itsdangerous is an interesting package to use crypto to stop us using local storage for things.

There are two major use cases:

1. For verification tokens in the emails.
2. For sessions.

the tokens are quite easy. I have a "proof of concept" branch at elrond/itsdangerous. The sessions aren't too complex either, but need some more thinking and some decisions.

We need to make up our mind: Do we want this?

Note: #580 might be related, because we are considering to drop beaker.

[Elrond]

Okay, some notes on my branch:

I have stopped working on it for now.
If someone wants to continue on this:

• Need to implement this also for the forgot password thing.
• Need to drop all the unneeded columns from the db
• Need harder permissions on the secrets file.
• Cleanup expiration times
• Make sure the testsuite works.

All of this is probably quite easy, so if you want to consider it, talk to me.

[Elrond]

Okay, I have reworked my branch (rebased, force updated).

It currently only contains the basic infrastructure for itsdangerous.

This is needed for #668, so please review for merging.

Please do not close after merging, because I still have the itsdangerous based email tokens in a local branch and we likely want those too or should discuss that.

[Christopher Allan Webber]

So, the elrond + bretts itsdangerous main branch has been merged. I'm passing this back to Elrond; I think the email tokens stuff is next to get this ticket wrapped up.

[Christopher Allan Webber]

Removing review keyword for now.

[Elrond]

I have a local, quick and dirty implementation of the email tokens.

If someone (hey, this is quite easy, maybe bitesized?) wants to improve my work (I think, I posted some notes above) and port this for forget password tokens, ping me and I'll post my branch somewhere public (and nicely rebased).

I'm tagging this bitesized, because we could need some bitesized tasks currently.

[bukosabino]

itsdangerous is worked for verifications tokens in emails (register and forgot password), without saving the token in user.verification_key, user.fp_verification_key and user.fp_token_expire fields.

I need to debate with Elrond how implements itsdangerous in sessions.

[Christopher Allan Webber]

We're using this for sessions, but I guess not verification tokens? Should that be its own ticket? Should this be closed out?

[Elrond]

Hi bukosabino,

sessions are done by now!

Where's your work on forget password, etc?

[Elrond]

Hi Chris,

I think, this ticket has become the "itsdangerous for mails" ticket. I hope we have another one for the sessions? I thought so?

[Elrond]

#624 is about sessions.

[rodney757]

​https://github.com/rodney757/mediagoblin/commits/mail

[rodney757]

When merged can close #107 as well

[Christopher Allan Webber]

Top notch work, Rodney! Everything in this branch seems really well done.

I've merged this. Thanks for your hard work on it!