id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
37440	Clarify directory permission requirements for file-based sessions	Sarah Boyce		"The file-based session backend includes the session ID in each session filename.
Hence, local users who can list the session directory can recover session IDs and could hijack authenticated sessions, even if they cannot read the files.
When `SESSION_FILE_PATH` is unset, Django uses the system’s temporary directory, which may be accessible to other local users.

The documentation currently mentions ensuring that the web server can read and write to the directory, but does not explain the need to restrict access by other users. The following docs should/could be updated to highlight this:
* https://docs.djangoproject.com/en/6.1/topics/http/sessions/#using-file-based-sessions
* https://docs.djangoproject.com/en/6.1/ref/settings/#std-setting-SESSION_FILE_PATH

Note that Django treats session storage as a trusted component, similar to the database and cache storage. Restricting access to that storage by untrusted local users is the deployer’s responsibility. Thank you ""you yang"" for the report."	Cleanup/optimization	new	contrib.sessions	6.1	Normal		not-security		Unreviewed	0	0	0	0	0	0