Issues signing string on Python 3

[ColdHeat]

This code works in Python 2 but doesn't seem to work properly in Python 3. Not a particularly complex example.

Python 3.6.1 (default, Apr  4 2017, 09:40:21)
[GCC 4.2.1 Compatible Apple LLVM 8.1.0 (clang-802.0.38)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> from itsdangerous import Signer
>>> s = Signer('AAAAAAAAAAAAAAAAAAAA')
>>> s.sign('user@user.com')
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/Users/kchung/.virtualenvs/ctfd3/lib/python3.6/site-packages/itsdangerous.py", line 353, in sign
    return value + want_bytes(self.sep) + self.get_signature(value)
TypeError: must be str, not bytes
>>>

[ColdHeat]

Seems like this is fixed in the repo but not on the itsdangerous version in PyPI. Any way we can get a new version or is there a workaround?

[ColdHeat]

Seems like the TimedSerializer does not suffer from this issue so I suppose that is the workaround.

[FaiChou]

➜  ~ pip3 list | grep danger -i
itsdangerous (0.24)
➜  ~ pip3 install -U itsdangerous
Requirement already up-to-date: itsdangerous in /usr/local/lib/python3.6/site-packages
➜  ~

I found the log return value + want_bytes(self.sep) + self.get_signature(value) is not the current version code. My version is 0.24.
So I upgraded, pip3 install -U itsdangerous, but failed with ** already up-to-date**.

Pretty bad. Go to sleep.

[BlackVoid]

You need to make sure the string you send to the sign method is a bytes array and you get a byte-array back.

Try this:

from itsdangerous import Signer
s = Signer('AAAAAAAAAAAAAAAAAAAA')
s.sign('user@user.com'.encode()).decode()

$ python
Python 3.6.3 (default, Oct  9 2017, 12:11:29) 
[GCC 7.2.1 20170915 (Red Hat 7.2.1-2)] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> from itsdangerous import Signer
>>> s = Signer('AAAAAAAAAAAAAAAAAAAA')
>>> s.sign('user@user.com'.encode()).decode()
'user@user.com.kprkCNw6tRBeyRfyikodq0JCXoA'

[RyanSquared]

@BlackVoid interestingly though, it says "must be str" rather than "must be bytes" ?

[davidism]

This will be fixed in the next release.