Repository navigation
feat(session)!: make ordinary session saves conditional - #417
Merged
Merged
Conversation
Add set_if_equals(key, expected, value, ttl=None) to every backend: the memory backend compares under its lock, Redis compares and re-checks in a Lua script, Memcached uses GETS + CAS, and BaseCacheBackend gets a non-atomic fallback. Sessions remember the backend entry they were last read from or written as. update_session(), sliding renewal in get_session() and the middleware's save of request.session store only while the backend still holds that entry, so a request cannot bring back a session that another request deleted, invalidated or rotated. Delete, invalidate, expire and ID rotation stay unconditional. A renewal that loses a race re-reads the session and retries once. A dropped middleware save is logged and sends no token, except a stored renewal for a session that is still valid. Session equality ignores the remembered entry. BREAKING CHANGE: update_session() returns a bool and drops a save that lost a race; when two requests change one session at once, the first save wins. A hand-built Session is stored only if no record exists under its ID. Closes #128
allen0099
added
backends
regenerate_session_id() removed the old record and wrote the in-memory copy under a new ID unconditionally, so a request that read a session before another request deleted or invalidated it could bring it back under a new ID. It now claims the old record with get_and_delete and goes ahead only if that record was still valid; of two concurrent rotations only the first succeeds. A session built by hand rotates as before. rotate_session_id() answers 401 and makes the middleware send and save nothing, since the winner of a concurrent rotation may already hold the client's new token. login() starts a new session for the user instead, without the ended session's data. BREAKING CHANGE: regenerate_session_id() raises SessionNotFoundError or SessionInvalidError when the session ended since it was read. Refs #128
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #128
Summary
set_if_equals(key, expected, value, ttl=None) -> bool: atomic on memory (under its lock), Redis (Lua compare +SET [EX]) and Memcached (GETS+CAS), with a non-atomic fallback onBaseCacheBackend.Sessionremembers the backend entry it was last read from or written as (a private attribute, not serialized, ignored by equality).update_session(), sliding renewal inget_session(), and the middleware's save ofrequest.session. Unconditional: create, delete, invalidate, expire — security actions always win.update_session()returnsTrue/False; a dropped save is logged at INFO. A hand-builtSessionis stored only if its ID is absent.regenerate_session_id()) claims the old record withget_and_deleteand goes ahead only if it was still valid, so a stale copy cannot come back under a new ID; of two concurrent rotations only the first succeeds.rotate_session_id()answers 401 and sends nothing;login()starts a new session for the user without the ended session's data.Breaking
When two requests change the same session at once, the first save wins (previously the last). Merging is tracked in #376. Documented in
MIGRATING_0_4.md#session-writes(en/zh-TW);BACKENDS.mdandSESSION.mdupdated.Tests
set_if_equalson base, memory, Redis and Memcached (including a change made between the compare and the write), plus the TTL contract.tests/session/test_conditional_saves.py: stale saves after delete / invalidate / rotation, concurrent saves, renewal races, middleware drops on cookie and header transports, and the renewal-token exception.