H00die/flask unsign

[zeroSteiner]

This makes some changes. I'll leave a review explaining the important ones.

[zeroSteiner]

I tested this with:

• Apache Superset
• A custom Flask app I run
• A stock Flask-app using the quick start

While testing these three instances I found a few issues and opportunities for improvements which I have implemented herein.

app.py

Most of the boiler plat was taken from the [Quickstart Guide.](https://flask.palletsprojects.com/en/2.3.x/quickstart/#sessions) Changes were made to ensure that `/` always created a session and included an additional cookie.

from flask import Flask, session, redirect, url_for, request, make_response
from markupsafe import escape

import random, string

app = Flask(__name__)

# Set the secret key to some random bytes. Keep this really secret!
app.secret_key = b'_5#y2L"F4Q8z\n\xec]/'
#app.secret_key = b'CHANGE_ME_TO_A_COMPLEX_RANDOM_SECRET'

@app.route('/')
def index():
    if not 'csrf_token' in session:
        session['csrf_token'] = ''.join(random.choices(string.ascii_lowercase, k=10))
    if 'username' in session:
        resp = make_response('Logged in as %s' % escape(session['username']))
    else:
        resp = make_response('You are not logged in')
    if not request.cookies.get('CSRF'):
        resp.set_cookie('CSRF', session['csrf_token'])
    return resp

@app.route('/login', methods=['GET', 'POST'])
def login():
    if request.method == 'POST':
        session['username'] = request.form['username']
        return redirect(url_for('index'))
    return '''
        <form method="post">
            <p><input type=text name=username>
            <p><input type=submit value=Login>
        </form>
    '''

@app.route('/logout')
def logout():
    # remove the username from the session if it's there
    session.pop('username', None)
    return redirect(url_for('index'))

[zeroSteiner]

This action didn't actually retrieve it. It functioned entirely offline.

[zeroSteiner]

Changed this name so if we need to add another signer in the future, we'll be in a better spot to do so before it's used all over the place.

[zeroSteiner]

This adds the display name to the output which might be handy and formats the rest as a connection string.

[zeroSteiner]

These advanced options grant more flexibility to the user so if non-default values are in use, the module will still work. Some Flask extensions such as Flask-Session use a non-default salt.

[zeroSteiner]

This was necessary to handle instances where the server returned more than one cookie.

[zeroSteiner]

I moved this file to follow the convention that what is being tested is the Session module which is a child of FlaskUnsign. If the modules are broken into new files, this one is already where it belongs.

[zeroSteiner]

New tests as requested 😄