New submission from Brian Sutherland <>:

Looking here it seems obvious that tokens is meant to be passed as a list/tuple:

However the auth_tkt plugin passes it as a string. The resulting cookie is 
obviously wrong:

I find it hard to believe that this bug was at large for such a long time. So, 
perhaps there's a reason for the current behavior? If so, 
please let me know, otherwise I'll commit the attached patch to fix this.

messages: 463
nosy: jinty
priority: bug
status: unread
title: repoze.who's auth_tkt plugin gives paste a string list of tokens
topic: repoze.who

Repoze Bugs <>
Repoze-dev mailing list

Reply via email to