Ticket #8122: 8122-rmaster.diff

django/contrib/sessions/backends/base.py

@@ -32 +32 @@
     """
     Base class for all Session classes.
     """
-    TEST_COOKIE_NAME = 'testcookie'
-    TEST_COOKIE_VALUE = 'worked'
 
     def __init__(self, session_key=None):
         self._session_key = session_key
         self.accessed = False
         self.modified = False
+        self.cookie_received = (session_key is not None)
         self.serializer = import_string(settings.SESSION_SERIALIZER)
 
     def __contains__(self, key):
@@ -71 +70 @@
             return value
 
     def set_test_cookie(self):
-        self[self.TEST_COOKIE_NAME] = self.TEST_COOKIE_VALUE
+        from warnings import warn
+        warn('set_test_cookie() is deprecated. It is no longer required.')
 
     def test_cookie_worked(self):
-        return self.get(self.TEST_COOKIE_NAME) == self.TEST_COOKIE_VALUE
+        from warnings import warn
+        warn('test_cookie_worked() is deprecated. Use request.cookie_received')
+        return self.cookie_received
 
     def delete_test_cookie(self):
-        del self[self.TEST_COOKIE_NAME]
+        from warnings import warn
+        warn('delete_test_cookie() is deprecated. It is no longer required.')
 
     def _hash(self, value):
         key_salt = "django.contrib.sessions" + self.__class__.__name__

django/contrib/sessions/middleware.py

@@ -36 +36 @@
                 if accessed:
                     patch_vary_headers(response, ('Cookie',))
                 if modified or settings.SESSION_SAVE_EVERY_REQUEST:
-                    if request.session.get_expire_at_browser_close():
-                        max_age = None
-                        expires = None
-                    else:
-                        max_age = request.session.get_expiry_age()
-                        expires_time = time.time() + max_age
-                        expires = cookie_date(expires_time)
-                    # Save the session data and refresh the client cookie.
-                    # Skip session save for 500 responses, refs #3881.
-                    if response.status_code != 500:
-                        request.session.save()
-                        response.set_cookie(settings.SESSION_COOKIE_NAME,
-                                request.session.session_key, max_age=max_age,
-                                expires=expires, domain=settings.SESSION_COOKIE_DOMAIN,
-                                path=settings.SESSION_COOKIE_PATH,
-                                secure=settings.SESSION_COOKIE_SECURE or None,
-                                httponly=settings.SESSION_COOKIE_HTTPONLY or None)
+                    # Save the session data and refresh the client cookie
+                    request.session.save()
+                    self.set_session_cookie(request, response,
+                            request.session.session_key)
+                elif not request.session.cookie_received:
+                    # Set a temporary cookie
+                    self.set_session_cookie(request, response, '')
+                            
         return response
+
+    def set_session_cookie(self, request, response, value):
+        if request.session.get_expire_at_browser_close():
+            max_age = None
+            expires = None
+        else:
+            max_age = request.session.get_expiry_age()
+            expires_time = time.time() + max_age
+            expires = cookie_date(expires_time)
+        response.set_cookie(settings.SESSION_COOKIE_NAME, value,
+                max_age=max_age, expires=expires,
+                domain=settings.SESSION_COOKIE_DOMAIN,
+                path=settings.SESSION_COOKIE_PATH,
+                secure=settings.SESSION_COOKIE_SECURE or None)

new file tests/regressiontests/sessions_regress/models.py

@@ +1 @@
+# models.py file for tests to run.

new file tests/regressiontests/sessions_regress/tests.py

@@ +1 @@
+# -*- coding: utf-8 -*-
+
+from django.test import TestCase
+from django.http import HttpRequest, HttpResponse
+from django.contrib.sessions.middleware import SessionMiddleware
+from django.conf import settings
+
+class SessionMiddlewareTest(TestCase):
+    def test_no_cookie(self):
+        """
+        Tests that the session middleware works when the client does not send
+        a session cookie.
+        """
+        middleware = SessionMiddleware()
+        request = HttpRequest()
+        middleware.process_request(request)
+        assert not request.session.cookie_received
+        response = middleware.process_response(request, HttpResponse())
+        assert settings.SESSION_COOKIE_NAME in response.cookies
+        assert response.cookies[settings.SESSION_COOKIE_NAME].value == ''
+
+    def test_empty_cookie(self):
+        """
+        Tests that the session middleware works when the client sends an empty
+        session cookie.
+        """
+        middleware = SessionMiddleware()
+        request = HttpRequest()
+        request.COOKIES[settings.SESSION_COOKIE_NAME] = ''
+        middleware.process_request(request)
+        assert request.session.cookie_received
+        response = middleware.process_response(request, HttpResponse())
+        assert not settings.SESSION_COOKIE_NAME in response.cookies
+
+    def test_valid_cookie(self):
+        """
+        Tests that the session middleware works when the client sends a valid
+        session cookie.
+        """
+        # First get valid session id
+        middleware = SessionMiddleware()
+        request = HttpRequest()
+        middleware.process_request(request)
+        request.session['test'] = 'test'
+        response = middleware.process_response(request, HttpResponse())
+        sessionid = response.cookies[settings.SESSION_COOKIE_NAME].value
+        assert sessionid != ''
+        # Now check behavior for valid session id
+        request = HttpRequest()
+        request.COOKIES[settings.SESSION_COOKIE_NAME] = sessionid
+        middleware.process_request(request)
+        assert request.session.cookie_received
+        assert request.session['test'] == 'test'
+        response = middleware.process_response(request, HttpResponse())
+        assert not settings.SESSION_COOKIE_NAME in response.cookies
+
+    def test_invalid_cookie(self):
+        """
+        Tests that the session middleware works when the client sends an
+        invalid session cookie.
+        """
+        # First get valid session id
+        middleware = SessionMiddleware()
+        request = HttpRequest()
+        middleware.process_request(request)
+        request.session['test'] = 'test'
+        response = middleware.process_response(request, HttpResponse())
+        sessionid = response.cookies[settings.SESSION_COOKIE_NAME].value
+        assert sessionid != ''
+        # Now check behavior for invalid session id
+        request = HttpRequest()
+        request.COOKIES[settings.SESSION_COOKIE_NAME] = 'invalid'
+        middleware.process_request(request)
+        assert request.session.cookie_received
+        assert 'test' not in request.session
+        response = middleware.process_response(request, HttpResponse())
+        assert settings.SESSION_COOKIE_NAME in response.cookies
+        assert response.cookies[settings.SESSION_COOKIE_NAME] != ''
+        assert response.cookies[settings.SESSION_COOKIE_NAME] != sessionid