Identify sessions by session key - a hash that can be safely shared.

tests/conftest.py

@@ -19,6 +19,7 @@ from collections.abc import AsyncGenerator
 from datetime import UTC, datetime, timedelta
 from uuid import UUID
 
+import base64url
 import httpx
 import pytest
 import pytest_asyncio
@@ -251,10 +252,10 @@ def create_test_session(
     ip: str = "127.0.0.1",
     user_agent: str = "pytest",
     duration: timedelta | None = None,
-) -> tuple[bytes, str]:
+) -> tuple[str, str]:
     """Create a test session. Returns (key, token) tuple.
 
-    - key: bytes used for session lookup (base64url encode for URLs)
+    - key: str used for session lookup (base64url encoded)
     - token: stored in cookie/sent to client
     """
     if duration is None:
@@ -267,7 +268,7 @@ def create_test_session(
 
     # Generate token and derive key
     token = secrets.token_urlsafe(12)
-    key = hash_secret("cookie", token)
+    key = base64url.enc(hash_secret("cookie", token))
 
     session = Session.create(
         user=user_uuid,