Demonware / jose

Python implementation of the Javascript Object Signing and Encryption (JOSE) framework (https://datatracker.ietf.org/wg/jose/charter/)
BSD 3-Clause "New" or "Revised" License
95 stars 34 forks source link

serialize_compact() on python3-branch returns bytes, which is considered unserializable #20

Open hmpf opened 8 years ago

hmpf commented 8 years ago

Python3's own json-library refuses to serialize the result of serialize_compact() since it is not a py3 str but a py3 bytes. This breaks our code, at the least. I'm not sure about the best way to solve it. A flag that sets encoding and if set spits out str and not bytes? Doing another walkthrough throught the code and choosing when to use str vs. bytes instead of always using bytes? Add to the json-library upstream so that it can serialize bytes, assuming that you tell it the encoding to use?

Anyway, the documentation for the function says it returns str, which it does not do on python3.

nmurtagh commented 8 years ago

Why would you want to JSON serialize a bytestring? What's the use case?

hmpf commented 8 years ago

A web-API that spits out JSON, and one of the things it spits out is JOSE tokens, as a value in a dictionary. In my code, I could just force it to text when making the key-value pair, but I don't think "fetch token via json API" is an unheard-of use-case.

... and the docstring is still wrong.

mjpieters commented 4 years ago

Why would you want to JSON serialize a bytestring? What's the use case?

This is Base64-encoded data, joined with . characters, but encoded as ASCII bytes. The compact encoding is meant to be treated as text, for cookies or embedding in JSON.

The documentation strings for the methods are wrong, they take / return bytes. The work-around is to decode and encode (as ASCII, but the default UTF-8 works too):

compact = jose.serialize_compact(jwe).decode()
# compact is an actual string now

# opposite direction
jwe = jose.deserialize_compact(compact.decode())

Either the docs or the implementation should be corrected.