Changeset 8459

Timestamp:

08/21/08 08:54:53 (11 months ago)

Author:

mtredinnick

Message:

When logging in, change the session key whilst preserving any existing
sesssion. This means the user will see their session preserved across a login
boundary, but somebody snooping the anonymous session key won't be able to view
the authenticated session data.

This is the final piece of the session key handling changes.

Files:

• django/trunk/django/contrib/auth/__init__.py (modified) (1 diff)
• django/trunk/django/contrib/sessions/backends/base.py (modified) (1 diff)
• django/trunk/django/contrib/sessions/tests.py (modified) (3 diffs)

django/trunk/django/contrib/auth/__init__.py

@@ -54 +54 @@
-    user.last_login = datetime.datetime.now()
-    user.save()
-
-
-
-
+
+
+
+
+
+
+
+
+
-    request.session[SESSION_KEY] = user.id
-    request.session[BACKEND_SESSION_KEY] = user.backend

django/trunk/django/contrib/sessions/backends/base.py

@@ -240 +240 @@
-        self.create()
-
+    def cycle_key(self):
+        """
+        Creates a new session key, whilst retaining the current session data.
+        """
+        data = self._session_cache
+        key = self.session_key
+        self.create()
+        self._session_cache = data
+        self.delete(key)
+
-    # Methods that child classes must implement.
-

django/trunk/django/contrib/sessions/tests.py

@@ -38 +38 @@
->>> db_session.modified, db_session.accessed
-(True, True)
+>>> db_session['a'], db_session['b'] = 'c', 'd'
+>>> db_session.save()
+>>> prev_key = db_session.session_key
+>>> prev_data = db_session.items()
+>>> db_session.cycle_key()
+>>> db_session.session_key == prev_key
+False
+>>> db_session.items() == prev_data
+True
-
-# Submitting an invalid session key (either by guessing, or if the db has
@@ -76 +85 @@
->>> file_session.modified, file_session.accessed
-(True, True)
+>>> file_session['a'], file_session['b'] = 'c', 'd'
+>>> file_session.save()
+>>> prev_key = file_session.session_key
+>>> prev_data = file_session.items()
+>>> file_session.cycle_key()
+>>> file_session.session_key == prev_key
+False
+>>> file_session.items() == prev_data
+True
+
->>> Session.objects.filter(pk=file_session.session_key).delete()
->>> file_session = FileSession(file_session.session_key)
@@ -113 +132 @@
->>> cache_session.modified, cache_session.accessed
-(True, True)
+>>> cache_session['a'], cache_session['b'] = 'c', 'd'
+>>> cache_session.save()
+>>> prev_key = cache_session.session_key
+>>> prev_data = cache_session.items()
+>>> cache_session.cycle_key()
+>>> cache_session.session_key == prev_key
+False
+>>> cache_session.items() == prev_data
+True
+
->>> Session.objects.filter(pk=cache_session.session_key).delete()
->>> cache_session = CacheSession(cache_session.session_key)