Raise a more appriopriate exception when session cannot be updated.

[Alex Vandiver]

django/contrib/sessions/middleware.py contains the only non-test place where a bare SuspiciousOperation is raised; all other locations use one of its more specific subclasses. Making this suspicious operation that involves a session into a raise SuspiciousSession would remove this outlier, and make the exception more specific.

This is also notable because every SuspiciousOperation subclass gets its own logger, so this is the only place that is logged via the django.security.SuspiciousOperation logger.

This should only require:

diff --git django/contrib/sessions/middleware.py django/contrib/sessions/middleware.py
index cb8c1ff45b..f8386a21ce 100644
--- django/contrib/sessions/middleware.py
+++ django/contrib/sessions/middleware.py
@@ -3,7 +3,7 @@ from importlib import import_module

 from django.conf import settings
 from django.contrib.sessions.backends.base import UpdateError
-from django.core.exceptions import SuspiciousOperation
+from django.contrib.sessions.exceptions import SuspiciousSession
 from django.utils.cache import patch_vary_headers
 from django.utils.deprecation import MiddlewareMixin
 from django.utils.http import http_date
@@ -60,7 +60,7 @@ class SessionMiddleware(MiddlewareMixin):
                     try:
                         request.session.save()
                     except UpdateError:
-                        raise SuspiciousOperation(
+                        raise SuspiciousSession(
                             "The request's session was deleted before the "
                             "request completed. The user may have logged "
                             "out in a concurrent request, for example."

[Mariusz Felisiak]

SuspiciousSession is better than SuspiciousOperation, but it's not a big improvement because this error is not really caused by user and there is nothing suspicious in it (see #27363). I think we should use a new exception class as ​proposed in the original PR.

[Hasan Ramezani]

@felixxm

I think we should use a new exception class

What do you think about SessionInterrupted as new exception class name?

[Hasan Ramezani]

​PR

[Mariusz Felisiak <felisiak.mariusz@…>]

In 2808cdc:

Fixed #31962 -- Made SessionMiddleware raise SessionInterrupted when session destroyed while request is processing.