Ticket #4724: session_cookie_path.patch

django/conf/global_settings.py

@@ -276 +276 @@
 SESSION_COOKIE_SECURE = False             # Whether the session cookie should be secure (https:// only).
 SESSION_SAVE_EVERY_REQUEST = False        # Whether to save the session data on every request.
 SESSION_EXPIRE_AT_BROWSER_CLOSE = False   # Whether sessions expire when a user closes his browser.
+SESSION_COOKIE_PATH = '/'                 # A string setting the path of the session cookie. 
 
 #########
 # CACHE #

django/contrib/sessions/middleware.py

@@ -109 +109 @@
                     datetime.datetime.now() + datetime.timedelta(seconds=settings.SESSION_COOKIE_AGE))
                 response.set_cookie(settings.SESSION_COOKIE_NAME, session_key,
                     max_age=max_age, expires=expires, domain=settings.SESSION_COOKIE_DOMAIN,
+                    path=settings.SESSION_COOKIE_PATH,
                     secure=settings.SESSION_COOKIE_SECURE or None)
         return response

docs/settings.txt

@@ -752 +752 @@
 The name of the cookie to use for sessions. This can be whatever you want.
 See the `session docs`_.
 
+SESSION_COOKIE_PATH
+-------------------
+
+Default: ``'/'``
+
+The path set on the session cookie. Should match the URL path of your
+Django installation. Useful if you want to keep other people using the same 
+domain name from accessing Django session cookies. If hosting a django 
+instance at www.example.com/foo then set path to "/foo".
+
 SESSION_COOKIE_SECURE
 ---------------------