`TimestampSigner` not working as expected when I use a `-` as separator about itsdangerous HOT 5 CLOSED

Here's what I think is going on.
The signature will be urlsafe_b64encode()d .
So part of the signature (and/or part of the timestamp) might contain your separator - , which would result in either a wrong timestamp or a wrong signature.

A potential fix could be to check if the separator is part of the base64_urlsafe() charset and/or write that in the docs.

How to reproduce.

for i in xrange(100):
    s = TimestampSigner('secret-key',sep='-')
    mystr = s.sign('foo')
    try:
        s.unsign(mystr,max_age=200)
    except:
        raise
    time.sleep(1)

Example string foo-CmVi_g-pt8iji6JAw61H0EJm-bFJumhEZw (signature will be bFJumhEZw instead of pt8iji6JAw61H0EJm-bFJumhEZw)

from itsdangerous.

I fixed it exactly as @johnlam described. I'm not considering this API breakage because this sort of usage never worked.

from itsdangerous.

I can't reproduce either error with the example given. If you got a signature expired, then you waited longer than 50 seconds before unsigning.

from itsdangerous.

Nope, I am not waiting more than 50 seconds, I am just checking instantly. Here is an video demo where I am just copy pasting repeatedly and you will see both the errors: http://gifyu.com/image/FHN

from itsdangerous.

I used the same code which I had posted earlier. Now I am not sure why its not generating error in your machine.

from itsdangerous.