Add extra information in token about django-sesame HOT 4 CLOSED

No, this isn't currently supported.

Adding this feature would require:

• adding an optional parameter to create_token, parse_token, and other functions that call them;
• inserting its content in the output of get_revocation_key.

This raises the question of serializing to bytes in a cryptographically secure way arbitrary Python objects. AFAIK __hash__ isn't cryptographically secure. Alternatively make the optional parameter a string or bytes only.

Generally speaking:

• if an attacker gets hold of a token you're in a bad place so I'm not sure I want to encourage this pattern;
• a GET request shouldn't have side effects; it should display a button that the recipient can click to approve the transaction, perhaps after checking some info.

So I'm not sure I want to move forwards with this.

from django-sesame.

I think part of this was inspired by jwt. jwt can store arbitrary pieces of information. e.g.

https://jwt.io/#debugger-io?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJ3aG8gd3JvdGUgbW9ieSBkaWNrUCI6Ikhlcm1hbiBNZWx2aWxsZSJ9.y9ogUARlJ8XAxeLgrojkALSGowLLpGTYiUZCMYWMfzs

from django-sesame.

I see. I'm not sure I'm willing to develop as much attack surface as JWT ;-)

from django-sesame.

I think #60 will help you do what you want. Make one scope per transaction e.g. scope = f"transaction-{transaction}" and you should be good.

from django-sesame.