python - What does itsdangerous do to sign the string? -

i want client send me signature can "unsign" found cool package written in python called itsdangerous need...

>>> itsdangerous import signer >>> s = signer('secret-key') >>> s.sign('things , me should know') 'my string.wh6tmhxlgjqb6oy1ut73imlyroa' >>> s.unsign('my string.wh6tmhxlgjqb6oy1ut73imlyroa') 'my string' 

it works perfectly, client not using python how sign string i.e. itsdangerous hash sting client needs recreate.

from their documentation

class itsdangerous.signer(secret_key, salt=none, sep='.', key_derivation=none, digest_method=none, algorithm=none)

this class can sign bytes , unsign , validate signature provided.

salt can used namespace hash, signed string valid given namespace. leaving @ default value or re-using salt value across different parts of application same signed value in 1 part can mean different in part security risk.

then hash (emphasis mine)

default_digest_method()
digest method use signer. this defaults sha1 can changed other function in hashlib module.

so assuming hash, , don't salt afterward, can reproduce result sha-1 hash.