Ending urls with a dash - makes for a poor experience on Thunderbird about django-sesame HOT 3 CLOSED

Hrm. Interesting one. Thanks for reporting it.

django-sesame is already using what Python's base64 module calls "URL-safe" base-64 encoding.

We need two non alphanumeric characters to have a total of 26 + 26 + 10 + 2 = 64 in the alphabet. The safest choices are unreserved characters: - / . / _ / ~. _ is good. We can't use . because it's already used for telling v1 tokens apart from v2 tokens. This leaves a choice between - and ~ for the second character. I don't see why one would be safer than the other.

I'm disinclined to make changes here:

• Thunderbird accepted the issue as a bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1418548
• Youtube has the same issue, and I think they have more users than django-sesame ;-)
• I have little evidence that the cure would be better than the disease
• I like to tread carefully when security meets backwards-compatibility

from django-sesame.

If you like Russian roulette:

import base64
base64._urlsafe_encode_translation = bytes.maketrans(b'+/', b'~_')
base64._urlsafe_encode_translation = bytes.maketrans(b'~_', b'+/')

I wouldn't recommend this, though.

from django-sesame.

I guess I over-reacted. If Youtube also has it and Tbird already accepted it this can be closed. Sorry for the noise. :P

from django-sesame.