Ticket #2133: session.diff

django/conf/global_settings.py

@@ -246 +246 @@
 SESSION_COOKIE_DOMAIN = None              # A string like ".lawrence.com", or None for standard domain cookie.
 SESSION_SAVE_EVERY_REQUEST = False        # Whether to save the session data on every request.
 SESSION_EXPIRE_AT_BROWSER_CLOSE = False   # Whether sessions expire when a user closes his browser.
+SESSION_COMPLAIN_IF_INVALID = False       # Whether to raise an error if the session cookie doesn't authenticate (instead of just ignoring it)
 
 #########
 # CACHE #

django/contrib/sessions/middleware.py

@@ -60 +60 @@
                     # Set the session_key to None to force creation of a new
                     # key, for extra security.
                     self.session_key = None
+                except SuspiciousOperation:
+                    if settings.SESSION_COMPLAIN_IF_INVALID:
+                        raise
+                    self._session_cache = {}
+                    self.session_key = None
             return self._session_cache
 
     _session = property(_get_session)

docs/sessions.txt

@@ -241 +241 @@
 
 The name of the cookie to use for sessions. This can be whatever you want.
 
+SESSION_SAVE_EVERY_REQUEST
+--------------------------
+
+Default: ``False``
+
+Whether to save the session data on every request. If this is ``False``
+(default), then the session data will only be saved if it has been modified --
+that is, if any of its dictionary values have been assigned or deleted.
+
+.. _Django settings: http://www.djangoproject.com/documentation/settings/
+
 SESSION_EXPIRE_AT_BROWSER_CLOSE
 -------------------------------
 
@@ -249 +260 @@
 Whether to expire the session when the user closes his or her browser. See
 "Browser-length sessions vs. persistent sessions" above.
 
-SESSION_SAVE_EVERY_REQUEST
---------------------------
+SESSION_COMPLAIN_IF_INVALID
+---------------------------
 
 Default: ``False``
 
-Whether to save the session data on every request. If this is ``False``
-(default), then the session data will only be saved if it has been modified --
-that is, if any of its dictionary values have been assigned or deleted.
+Whether to raise an error if the session cookie doesn't authenticate
+correctly. This can happen two ways: either you change a site's
+``SECRET_KEY``, or someone tries to hack your site by creating a
+cookie of their own. By default, Django will ignore invalid cookies,
+and act as if the client didn't present a cookie at all. Turning this
+flag on will make warn the user that the cookie their browser sent was
+invalid.
 
-.. _Django settings: http://www.djangoproject.com/documentation/settings/
-
 Technical details
 =================