Flask-Session can't import itsdangerous.want_bytes

[Jordan-meek]

Hi ,

We are currently hosting a Flask application on AWS using python 2.7.14, with flask-1.0.2 and flask-session-0.3.1.

AWS Environment:
Python 2.7 running on 64bit Amazon Linux/2.7.3
flask versions being used:
flask-1.0.2 flask-session-0.3.1

When we cloned our environment the following error appears:

[Fri Oct 19 16:39:49.340104 2018] [:error] [pid 2790] [remote 127.0.0.1:0] from flask_session import Session
[Fri Oct 19 16:39:49.340135 2018] [:error] [pid 2790] [remote 127.0.0.1:0] File "/opt/python/run/venv/local/lib64/python2.7/site-packages/flask_session/init.py", line 16, in
[Fri Oct 19 16:39:49.340269 2018] [:error] [pid 2790] [remote 127.0.0.1:0] from .sessions import NullSessionInterface, RedisSessionInterface, \
[Fri Oct 19 16:39:49.340296 2018] [:error] [pid 2790] [remote 127.0.0.1:0] File "/opt/python/run/venv/local/lib64/python2.7/site-packages/flask_session/sessions.py", line 23, in
[Fri Oct 19 16:39:49.340613 2018] [:error] [pid 2790] [remote 127.0.0.1:0] from itsdangerous import Signer, BadSignature, want_bytes
[Fri Oct 19 16:39:49.340653 2018] [:error] [pid 2790] [remote 127.0.0.1:0] ImportError: cannot import name want_bytes

Old environment uses itsdangerous 0.24 while the new environment is using 1.0.0.

We resolved this problem by adding itsdangerous version 0.24 to our requirements.txt file.

Thank you,

Jordan

[davidism]

As the changelog says:

Refactor code from a single module to a package. Any object in the API docs is still importable from the top-level itsdangerous name, but other imports will need to be changed. A future release will remove many of these compatibility imports. (#107)

want_bytes was not part of the public API, so it is not available as a top level import in the new structure.

It looks like the issue is with Flask-Session, which imports non-public names. You should open an issue and/or pull request with that project to fix this issue.