'data_serializer': 'json' causes TypeError: Object of type datetime is not JSON serializable caused by on _expires attribute

[JamieBeverley]

Overview

Using session.data_serializer=json produces the following error (full stack trace below):

TypeError: Object of type datetime is not JSON serializable

Details

• The _expires attribute is set on a CookieSession to a datetime object here
• When that cookie is serialized to json, an error is through as datetimes are not JSON serializable
• This error seems to only occur after the 2nd time a cookie is .save()d: only after the first .save() the _expires attribute is set to a datetime on the cookie and then subsequent uses of the cookie fail at serialization.

Reproducible Example

Test Case

from beaker.session import CookieSession

COOKIE_REQUEST = {}

options = {
    'invalidate_corrupt': True,
    'type': 'cookie',
    'data_dir': None,
    'key': 'ckan',
    'timeout': None,
    'save_accessed_time': True,
    'secret': '12341234',
    'log_file': None,
    'data_serializer': 'json',
    'validate_key': 'asdfasdf',
    'httponly': True,
    'secure': False,
    'samesite': 'Strict',
    'auto': False,
    'cookie_expires': False,
    'cookie_domain': None
}

def test_cookie_serialize_json_can_be_saved():
    cookie_session = CookieSession(COOKIE_REQUEST, **options)
    cookie_session.save()
    # 2nd call to .save() causes the error
    cookie_session.save()

if __name__=='__main__':
    test_cookie_serialize_json_can_be_saved()

Flask

• open localhost:5000 -> expect to load fine the first time
• refresh the page -> json serialization error

from flask import Flask, request
from beaker.middleware import SessionMiddleware

app = Flask(__name__)

session_opts = {
    'session.key': 'session-key',
    'session.secret': '12341234',
    'session.type': 'cookie',
    'session.data_serializer': 'json',
    'session.validate_key': 'asdfasdf',
    'session.httponly': True,
    'session.secure': False,
    'session.samesite': 'Strict',
    'session.auto': False,
    'session.cookie_expires': False,
    'session.cookie_domain': None,
    'session.save_accessed_time': True,
    'session.timeout': None,
}

app.wsgi_app = SessionMiddleware(app.wsgi_app, session_opts)

@app.route('/', methods=['GET'])
def set_session():
    session = request.environ['beaker.session']
    session['count'] = session.get('count',0) + 1
    session.save()
    return f"<h1>Session updated</h1><p>Session: <code>{session}</code></p>"

if __name__ == '__main__':
    app.run(debug=True)

Full Stack Trace

Traceback (most recent call last):
  File ".../beaker-test/repro.py", line 29, in <module>
    test_cookie_serialize_json_can_be_saved()
  File ".../beaker-test/repro.py", line 27, in test_cookie_serialize_json_can_be_saved
    cookie_session.save()
  File ".../beaker-test/beaker/beaker/session.py", line 723, in save
    self._create_cookie()
  File ".../beaker-test/beaker/beaker/session.py", line 737, in _create_cookie
    val = self._encrypt_data()
          ^^^^^^^^^^^^^^^^^^^^
  File ".../beaker-test/beaker/beaker/session.py", line 381, in _encrypt_data
    data = self.serializer.dumps(session_data)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File ".../beaker-test/beaker/beaker/util.py", line 469, in dumps
    return zlib.compress(json.dumps(data).encode('utf-8'))
                         ^^^^^^^^^^^^^^^^
  File ".../python/3.11.10/lib/python3.11/json/__init__.py", line 231, in dumps
    return _default_encoder.encode(obj)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File ".../python/3.11.10/lib/python3.11/json/encoder.py", line 200, in encode
    chunks = self.iterencode(o, _one_shot=True)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File ".../python/3.11.10/lib/python3.11/json/encoder.py", line 258, in iterencode
    return _iterencode(o, 0)
           ^^^^^^^^^^^^^^^^^
  File ".../python/3.11.10/lib/python3.11/json/encoder.py", line 180, in default
    raise TypeError(f'Object of type {o.__class__.__name__} '
TypeError: Object of type datetime is not JSON serializable

[JamieBeverley]

It seems this is specifc to (or at least sensitive to) the session.cookie_expires parameter.
When set to False (or None since None seems to default to False) or a timedelta we get a JSON serialization error.

However when set to session.cookie_expires = true the error does not occur.

Example to illustrate (similar to the above):

from beaker.session import CookieSession
from datetime import timedelta

COOKIE_REQUEST = {}

options = {
    'invalidate_corrupt': True,
    'type': 'cookie',
    'data_dir': None,
    'key': 'ckan',
    'timeout': None,
    'save_accessed_time': True,
    'secret': '12341234',
    'log_file': None,
    'data_serializer': 'json',
    'validate_key': 'asdfasdf',
    'httponly': True,
    'secure': False,
    'samesite': 'Strict',
    'auto': False,
    'cookie_domain': None
}

def test_cookie_serialize_json_can_be_saved(cookie_expires):
    if cookie_expires is not None:
        options["cookie_expires"] = cookie_expires
    elif "cookie_expires" in options:
        del options["cookie_expires"]

    cookie_session = CookieSession(
        COOKIE_REQUEST,
        **options,
    )
    cookie_session.save()
    cookie_session.save()


if __name__ == "__main__":
    for cookie_expires in (None, True, False, timedelta(seconds=10)):
        try:
            test_cookie_serialize_json_can_be_saved(cookie_expires)
        except TypeError as exc:
            print(f"failed for: cookie_expires={cookie_expires}:")
            print(exc)

Output:

$ python repro.py
failed for: cookie_expires=False:
Object of type datetime is not JSON serializable
failed for: cookie_expires=0:00:10:
Object of type datetime is not JSON serializable

[amol-]

Fixed