starlette icon indicating copy to clipboard operation
starlette copied to clipboard

Add `digest_method` to `SessionMiddleware`

Open bcarroll opened this issue 4 months ago • 0 comments

Summary

itsdangerous includes a patch for this issue, but the TimestampSigner used in SessionMiddleware does not allow the digest_method to be changed from the itsdangerous default, which is SHA1, and causes SessionMiddleware to generate an exception in a ubi8/ubi9 RedHat container. This commit allows the Starlette Session Middleware to support FIPS builds without SHA-1 by adding a digest_method parameter to the constructor.

Checklist

  • [x] I understand that this PR may be closed in case there was no previous discussion. (This doesn't apply to typos!)
  • [x] I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
  • [x] I've updated the documentation accordingly.

bcarroll avatar Aug 25 '25 13:08 bcarroll