Flask SecureCookie replacing pickle with json results in encoding error

Question

Below is werkzeug's recommendation for session serialization: The default implementation uses Pickle as this is the only module that used to be available in the standard library when this module was created. If you have simplejson available it’s strongly recommended to create a subclass and replace the serialization method: When I do this following both the Flask implementation below: https://gist.github.com/runfalk/2501926 or alternatively ``` from werkzeug.contrib.securecookie import SecureCookie Secure_Cookie.serialization_method = json ``` UnicodeDecodeError: 'utf8' codec can't decode byte 0x97 in position 0: invalid start byte This happens when I attempt to login. I have delved into the json encoder source and attempted to set `ensure_ascii=False` and this got me past the error above but then I just couldn't log into the application at all. It would just flash the screen with no error and I remained stuck at the login prompt. With pickle everything works fine. An important side n…

Accepted Answer

There is a method in `flask_login.py` called `_create_identifier`. The result of this invocation is a md5 `digest()` result. According to the docs this can contain non-ascii characters and/or null bytes. When handed to the `serialization_method` it is unable to decode the unicode bytes.

This bug definitely exists in the combination of Flask 0.9 and Flask-login 0.1.3 and can be fixed by monkey patching this gist(https://gist.github.com/anonymous/3731115) into the flask_login.py file or you can pull the latest out of development.

You can refer to this bug on their github repo if you need more info https://github.com/maxcountryman/flask-login/pull/31

Flask SecureCookie replacing pickle with json results in encoding error

Solution

Problem