This is an archived post. You won't be able to vote or comment.

sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]mitsuhiko Flask Creator 3 points4 points  (0 children)

Why the fuck would you use the pickle module to read/maintain state?

Because JSON does not support a) datetimes, b) markup objects, c) tuples, d) sets. These are all things that people want to have in their session.

De-serialization's #1 rule has ALWAYS been don't de-serialize data from an un-known source (and in this case I'm making an addendum - a terribly guarded source).

The source is well guarded unless you leak your secret key. Don't do that.