`URLSafeSerializer.dumps` may return `bytes`

[stgn]

>>> import msgpack
>>> from itsdangerous import URLSafeSerializer
>>> s = URLSafeSerializer("secret")
>>> s.dumps({"id": 123})
'eyJpZCI6MTIzfQ.UIuiA6AeHCMVakMgReamCo8eHes'
>>> s = URLSafeSerializer("secret", serializer=msgpack) 
>>> s.dumps({"id": 123})
b'gaJpZHs.5dxbKqWJ035xXL4QPY7qC6d2WS4'

I'm assuming this is unintentional.

Additionally, typing information states that the return type of URLSafeSerializer.dumps is str, since URLSafeSerializer is a subclass of Serializer[str]. Evidently, this is false.

Environment:

• Python version: 3.13
• ItsDangerous version: 2.2.0

[davidism]

It returns whatever the serializer returns. You can write a wrapper if you want msgpack to return str instead. Happy to review a PR if the types are not expressed properly.

[RazerM]

I just ran into this issue by opting some existing code into type checking. I don't think I can wrap a serializer like cbor2/msgpack to return str since they're not valid as strings until URLSafeSerializerMixin encodes to base64.

[maithili31]

We can use a wrapper serializer that base64-encodes msgpack output into a string, since URLSafeSerializer expects str, not bytes and then pass it to URLSafeSerializer(...) — this fixes both the runtime issue and the typing mismatch.

[RazerM]

I think this is still an issue.

@maithili31 in that case the payload is base64 encoded twice — once by your wrapper and once by URLSafeSerializer, which increases the payload size by 33%

The correct workaround is cast(bytes, serializer.dumps(payload))