Allow SessionStore's to be easily overridden to make dynamic the session cookie age

[Jaime Herencia Enjuto]

If I want to make dynamic my SESSION_COOKIE_AGE setting based on certain parameters of the session I need to reimplement in my SessionStore subclasses the following methods:

• get_expiry_age
• get_expiry_date

just to override the points where settings.SESSION_COOKIE_AGE is used.

[Jaime Herencia Enjuto]

I've created a pull request: ​https://github.com/django/django/pull/9318

[Tomer Chachamu]

That seems useful.

[Tomer Chachamu]

Actually, it looks like you can call SessionStore.set_expiry? One place to do so would be in a middleware that's listed below the session middleware, when processing a response.

class SessionExpiryPolicyMiddleware(object):
    def __init__(self, get_response):
        self.get_response = get_response
   
    def __call__(self, request):

        response = self.get_response(request)

        if response.session.modified and response.status_code != 500:
             response.session.set_expiry(response.session.calculate_expiry())

        return response

[Jaime Herencia Enjuto]

You are right that could be a way to achieve this, I know there are other ways to do this but don't you think that the responsible of calculating Session expirations should be the SessionStore not a middleware?

[Tomer Chachamu]

I think it would be worth discussing in the django-developers mailing list.

[Tim Graham]

A test should be added so the change isn't inadvertently refactored away.

[Mariusz Felisiak]

​PR

[Mariusz Felisiak <felisiak.mariusz@…>]

In 9d6f981a:

Fixed #28763 -- Allowed overriding the session cookie age with SessionStore.get_session_cookie_age().