b64_encode needed in README? about aiohttp-session HOT 2 CLOSED

In fact, the output is in bytes, and then the constructor for EncryptedCookieStorage calls urlsafe_b64encode() again! So, in the end, you have an 80 character secret key, which is almost twice the length needed.

So, it seems to me that the correct approach is to decode the bytes first, so it's not b64decoded later. Perhaps an even better approach would be to allow a Fernet to be passed in directly, to avoid this second-guessing about whether it's b64decoded or not?

from aiohttp-session.

OK, I've just realised that I missed the encode/decode differences.

Still, the code creates a valid b64encoded bytes object. (In README)
Then decodes it. (In README)
Then encodes it. (In EncryptedCookieStorage())
Then decodes it. (In Fernet())

That doesn't make sense to me, the middle 2 steps shouldn't exist.
Doing generate_key().decode() to convert to a string is enough to skip the middle steps, though it would still be better to pass the generated key through untouched.

from aiohttp-session.