Ticket #8122: 8122-r8277.diff

django/contrib/sessions/backends/base.py

@@ -18 +18 @@
     """
     Base class for all Session classes.
     """
-    TEST_COOKIE_NAME = 'testcookie'
-    TEST_COOKIE_VALUE = 'worked'
 
     def __init__(self, session_key=None):
         self._session_key = session_key
         self.accessed = False
         self.modified = False
+        self.cookie_received = (session_key is not None)
 
     def __contains__(self, key):
         return key in self._session
@@ -62 +61 @@
             return value
 
     def set_test_cookie(self):
-        self[self.TEST_COOKIE_NAME] = self.TEST_COOKIE_VALUE
+        from warnings import warn
+        warn('set_test_cookie() is deprecated. It is no longer required.')
 
     def test_cookie_worked(self):
-        return self.get(self.TEST_COOKIE_NAME) == self.TEST_COOKIE_VALUE
+        from warnings import warn
+        warn('test_cookie_worked() is deprecated. Use request.cookie_received')
+        return self.cookie_received
 
     def delete_test_cookie(self):
-        del self[self.TEST_COOKIE_NAME]
+        from warnings import warn
+        warn('delete_test_cookie() is deprecated. It is no longer required.')
 
-    def encode(self, session_dict):
+    def encode(self, session_dict):
         "Returns the given session dictionary pickled and encoded as a string."
         pickled = pickle.dumps(session_dict, pickle.HIGHEST_PROTOCOL)
         pickled_md5 = md5_constructor(pickled + settings.SECRET_KEY).hexdigest()

django/contrib/sessions/middleware.py

@@ -22 +22 @@
             if accessed:
                 patch_vary_headers(response, ('Cookie',))
             if modified or settings.SESSION_SAVE_EVERY_REQUEST:
-                if request.session.get_expire_at_browser_close():
-                    max_age = None
-                    expires = None
-                else:
-                    max_age = request.session.get_expiry_age()
-                    expires_time = time.time() + max_age
-                    expires = cookie_date(expires_time)
                 # Save the session data and refresh the client cookie.
                 request.session.save()
-                response.set_cookie(settings.SESSION_COOKIE_NAME,
-                        request.session.session_key, max_age=max_age,
-                        expires=expires, domain=settings.SESSION_COOKIE_DOMAIN,
-                        path=settings.SESSION_COOKIE_PATH,
-                        secure=settings.SESSION_COOKIE_SECURE or None)
+                self.set_session_cookie(request, response,
+                        request.session.session_key)
+            elif not request.session.cookie_received:
+                # Set a temporary cookie
+                self.set_session_cookie(request, response, '')
         return response
+
+    def set_session_cookie(self, request, response, value):
+        if request.session.get_expire_at_browser_close():
+            max_age = None
+            expires = None
+        else:
+            max_age = request.session.get_expiry_age()
+            expires_time = time.time() + max_age
+            expires = cookie_date(expires_time)
+        response.set_cookie(settings.SESSION_COOKIE_NAME, value,
+                max_age=max_age, expires=expires,
+                domain=settings.SESSION_COOKIE_DOMAIN,
+                path=settings.SESSION_COOKIE_PATH,
+                secure=settings.SESSION_COOKIE_SECURE or None)

tests/regressiontests/sessions_regress/tests.py

@@ +1 @@
+# -*- coding: utf-8 -*-
+
+from django.test import TestCase
+from django.http import HttpRequest, HttpResponse
+from django.contrib.sessions.middleware import SessionMiddleware
+from django.conf import settings
+
+class SessionMiddlewareTest(TestCase):
+    def test_no_cookie(self):
+        """
+        Tests that the session middleware works when the client does not send
+        a session cookie.
+        """
+        middleware = SessionMiddleware()
+        request = HttpRequest()
+        middleware.process_request(request)
+        assert not request.session.cookie_received
+        response = middleware.process_response(request, HttpResponse())
+        assert settings.SESSION_COOKIE_NAME in response.cookies
+        assert response.cookies[settings.SESSION_COOKIE_NAME].value == ''
+
+    def test_empty_cookie(self):
+        """
+        Tests that the session middleware works when the client sends an empty
+        session cookie.
+        """
+        middleware = SessionMiddleware()
+        request = HttpRequest()
+        request.COOKIES[settings.SESSION_COOKIE_NAME] = ''
+        middleware.process_request(request)
+        assert request.session.cookie_received
+        response = middleware.process_response(request, HttpResponse())
+        assert not settings.SESSION_COOKIE_NAME in response.cookies
+
+    def test_valid_cookie(self):
+        """
+        Tests that the session middleware works when the client sends a valid
+        session cookie.
+        """
+        # First get valid session id
+        middleware = SessionMiddleware()
+        request = HttpRequest()
+        middleware.process_request(request)
+        request.session['test'] = 'test'
+        response = middleware.process_response(request, HttpResponse())
+        sessionid = response.cookies[settings.SESSION_COOKIE_NAME].value
+        assert sessionid != ''
+        # Now check behavior for valid session id
+        request = HttpRequest()
+        request.COOKIES[settings.SESSION_COOKIE_NAME] = sessionid
+        middleware.process_request(request)
+        assert request.session.cookie_received
+        assert request.session['test'] == 'test'
+        response = middleware.process_response(request, HttpResponse())
+        assert not settings.SESSION_COOKIE_NAME in response.cookies
+
+    def test_invalid_cookie(self):
+        """
+        Tests that the session middleware works when the client sends an
+        invalid session cookie.
+        """
+        # First get valid session id
+        middleware = SessionMiddleware()
+        request = HttpRequest()
+        middleware.process_request(request)
+        request.session['test'] = 'test'
+        response = middleware.process_response(request, HttpResponse())
+        sessionid = response.cookies[settings.SESSION_COOKIE_NAME].value
+        assert sessionid != ''
+        # Now check behavior for invalid session id
+        request = HttpRequest()
+        request.COOKIES[settings.SESSION_COOKIE_NAME] = 'invalid'
+        middleware.process_request(request)
+        assert request.session.cookie_received
+        assert 'test' not in request.session
+        response = middleware.process_response(request, HttpResponse())
+        assert settings.SESSION_COOKIE_NAME in response.cookies
+        assert response.cookies[settings.SESSION_COOKIE_NAME] != ''
+        assert response.cookies[settings.SESSION_COOKIE_NAME] != sessionid

tests/regressiontests/sessions_regress/models.py

@@ +1 @@
+# models.py file for tests to run.