Securing 'pickle'

[Paul Rubin]

Ben Finney <bignose-hates-spam at and-zip-does-too.com.au> writes:
> Why not store the pickles on the server, and set a session cookie to
> refer to them?  That way, you only send a short session ID instead of
> the whole pickle, and messing with the cookie doesn't alter the pickles.

Because now you need a mechanism to store the session info on the
server, and you might want it to work across multiple load-balanced
servers that fail over to one another, etc.

To the OP: I'd be very careful of any attempt to unpickle untrusted
strings.  At minimum I'd say you should authenticate your cookies to
make sure no one has messed with them.  Configure a secret string into
the server, and use the hmac module to append a MAC to each cookie and
check the MAC before unpickling.  Or use that BitTorrent serializer
but modify it to include floats if you need that.