diff --git a/django/contrib/sessions/backends/base.py b/django/contrib/sessions/backends/base.py index 3b24b8d..d734351 100644 --- a/django/contrib/sessions/backends/base.py +++ b/django/contrib/sessions/backends/base.py @@ -32,13 +32,12 @@ class SessionBase(object): """ Base class for all Session classes. """ - TEST_COOKIE_NAME = 'testcookie' - TEST_COOKIE_VALUE = 'worked' def __init__(self, session_key=None): self._session_key = session_key self.accessed = False self.modified = False + self.cookie_received = (session_key is not None) self.serializer = import_string(settings.SESSION_SERIALIZER) def __contains__(self, key): @@ -71,13 +70,17 @@ class SessionBase(object): return value def set_test_cookie(self): - self[self.TEST_COOKIE_NAME] = self.TEST_COOKIE_VALUE + from warnings import warn + warn('set_test_cookie() is deprecated. It is no longer required.') def test_cookie_worked(self): - return self.get(self.TEST_COOKIE_NAME) == self.TEST_COOKIE_VALUE + from warnings import warn + warn('test_cookie_worked() is deprecated. Use request.cookie_received') + return self.cookie_received def delete_test_cookie(self): - del self[self.TEST_COOKIE_NAME] + from warnings import warn + warn('delete_test_cookie() is deprecated. It is no longer required.') def _hash(self, value): key_salt = "django.contrib.sessions" + self.__class__.__name__ diff --git a/django/contrib/sessions/middleware.py b/django/contrib/sessions/middleware.py index 69ca669..f1af3de 100644 --- a/django/contrib/sessions/middleware.py +++ b/django/contrib/sessions/middleware.py @@ -36,21 +36,26 @@ class SessionMiddleware(object): if accessed: patch_vary_headers(response, ('Cookie',)) if modified or settings.SESSION_SAVE_EVERY_REQUEST: - if request.session.get_expire_at_browser_close(): - max_age = None - expires = None - else: - max_age = request.session.get_expiry_age() - expires_time = time.time() + max_age - expires = cookie_date(expires_time) - # Save the session data and refresh the client cookie. - # Skip session save for 500 responses, refs #3881. - if response.status_code != 500: - request.session.save() - response.set_cookie(settings.SESSION_COOKIE_NAME, - request.session.session_key, max_age=max_age, - expires=expires, domain=settings.SESSION_COOKIE_DOMAIN, - path=settings.SESSION_COOKIE_PATH, - secure=settings.SESSION_COOKIE_SECURE or None, - httponly=settings.SESSION_COOKIE_HTTPONLY or None) + # Save the session data and refresh the client cookie + request.session.save() + self.set_session_cookie(request, response, + request.session.session_key) + elif not request.session.cookie_received: + # Set a temporary cookie + self.set_session_cookie(request, response, '') + return response + + def set_session_cookie(self, request, response, value): + if request.session.get_expire_at_browser_close(): + max_age = None + expires = None + else: + max_age = request.session.get_expiry_age() + expires_time = time.time() + max_age + expires = cookie_date(expires_time) + response.set_cookie(settings.SESSION_COOKIE_NAME, value, + max_age=max_age, expires=expires, + domain=settings.SESSION_COOKIE_DOMAIN, + path=settings.SESSION_COOKIE_PATH, + secure=settings.SESSION_COOKIE_SECURE or None) diff --git a/tests/regressiontests/sessions_regress/models.py b/tests/regressiontests/sessions_regress/models.py new file mode 100644 index 0000000..71abcc5 --- /dev/null +++ b/tests/regressiontests/sessions_regress/models.py @@ -0,0 +1 @@ +# models.py file for tests to run. diff --git a/tests/regressiontests/sessions_regress/tests.py b/tests/regressiontests/sessions_regress/tests.py new file mode 100644 index 0000000..8f68963 --- /dev/null +++ b/tests/regressiontests/sessions_regress/tests.py @@ -0,0 +1,79 @@ +# -*- coding: utf-8 -*- + +from django.test import TestCase +from django.http import HttpRequest, HttpResponse +from django.contrib.sessions.middleware import SessionMiddleware +from django.conf import settings + +class SessionMiddlewareTest(TestCase): + def test_no_cookie(self): + """ + Tests that the session middleware works when the client does not send + a session cookie. + """ + middleware = SessionMiddleware() + request = HttpRequest() + middleware.process_request(request) + assert not request.session.cookie_received + response = middleware.process_response(request, HttpResponse()) + assert settings.SESSION_COOKIE_NAME in response.cookies + assert response.cookies[settings.SESSION_COOKIE_NAME].value == '' + + def test_empty_cookie(self): + """ + Tests that the session middleware works when the client sends an empty + session cookie. + """ + middleware = SessionMiddleware() + request = HttpRequest() + request.COOKIES[settings.SESSION_COOKIE_NAME] = '' + middleware.process_request(request) + assert request.session.cookie_received + response = middleware.process_response(request, HttpResponse()) + assert not settings.SESSION_COOKIE_NAME in response.cookies + + def test_valid_cookie(self): + """ + Tests that the session middleware works when the client sends a valid + session cookie. + """ + # First get valid session id + middleware = SessionMiddleware() + request = HttpRequest() + middleware.process_request(request) + request.session['test'] = 'test' + response = middleware.process_response(request, HttpResponse()) + sessionid = response.cookies[settings.SESSION_COOKIE_NAME].value + assert sessionid != '' + # Now check behavior for valid session id + request = HttpRequest() + request.COOKIES[settings.SESSION_COOKIE_NAME] = sessionid + middleware.process_request(request) + assert request.session.cookie_received + assert request.session['test'] == 'test' + response = middleware.process_response(request, HttpResponse()) + assert not settings.SESSION_COOKIE_NAME in response.cookies + + def test_invalid_cookie(self): + """ + Tests that the session middleware works when the client sends an + invalid session cookie. + """ + # First get valid session id + middleware = SessionMiddleware() + request = HttpRequest() + middleware.process_request(request) + request.session['test'] = 'test' + response = middleware.process_response(request, HttpResponse()) + sessionid = response.cookies[settings.SESSION_COOKIE_NAME].value + assert sessionid != '' + # Now check behavior for invalid session id + request = HttpRequest() + request.COOKIES[settings.SESSION_COOKIE_NAME] = 'invalid' + middleware.process_request(request) + assert request.session.cookie_received + assert 'test' not in request.session + response = middleware.process_response(request, HttpResponse()) + assert settings.SESSION_COOKIE_NAME in response.cookies + assert response.cookies[settings.SESSION_COOKIE_NAME] != '' + assert response.cookies[settings.SESSION_COOKIE_NAME] != sessionid