yurenchen000
commented
2 years ago 〇. found the answer: it is expected effect.
note in demo:
# NOTE
# For demonstration purpose, we use a mock-up globally-shared session object.一. some change for demo
change client to use independent sessions, closer to the usual situation.
- custom SessionPool for test purpose.
# NOTE: just for test purpose, in RAM & no expire
class MySessionPool:
POOL = {} # session pool //in server RAM
KEY = 'session' # cookie key //in client cookie
@classmethod
def print_pool(c, key=None):
print('\033[33m -- session_pool:', len(c.POOL))
for k,v in c.POOL.items():
print(' -', k, v)
print('\033[0m')
@classmethod
# key from cookie, val from pool[key]
def read_session(c, request):
session_key = request.cookies.get(c.KEY, None) # get key from cookie
if not session_key:
session = {} # dummy
else:
session = c.POOL.get(session_key, {}) # get session from pool
return session
@classmethod
# key to cookie, val to pool[key]
def save_session(c, response, session):
while (key := secrets.token_urlsafe(32)) in c.POOL: pass
c.POOL[key] = session # save val to pool[key]
response.cookies[c.KEY] = key # save key to client cookie
c.print_pool()
@classmethod
# clr cookie, del session
def del_session(c, request, response):
# del session from pool
key = request.cookies.get(c.KEY, None)
if key: c.POOL.pop(key, None)
# del cookie from client
response.cookies[c.KEY] = ''
response.cookies[c.KEY]['max-age'] = 0
c.print_pool()- read session (in middleware) when request start:
@app.middleware('request')
async def add_session(request):
# request.ctx.session = session
### read session
request.ctx.session = MySessionPool.read_session(request)- save session when login success:
# async def login(request):
# if ...
user = User(id=1, name=username)
auth.login_user(request, user)
# return response.redirect('/', )
### save session
resp = response.redirect('/')
MySessionPool.save_session(resp, request.ctx.session)
return resp- clear session when logout:
@app.route('/logout')
@auth.login_required
async def logout(request):
auth.logout_user(request)
# return response.redirect('/login')
### clr session
resp = response.redirect('/login')
MySessionPool.del_session(request, resp)
return resphave to call MySessionPool everywhere manually, that's not good.
so I wirte demo1_2.py in below reply.
then, every client has their own session.
二. tests
// 0. no login
$ curl -sv 'http://localhost:8004'
> GET / HTTP/1.1
> Host: localhost:8004
> User-Agent: curl/7.68.0
> Accept: */*
>
< HTTP/1.1 302 Found
< Location: /login
< content-length: 0
< connection: keep-alive
< content-type: text/html; charset=utf-8
<
* Connection #0 to host localhost left intact// 1. login
$ curl -sv 'http://localhost:8004/login' -Fusername=demo -Fpassword=1234
> POST /login HTTP/1.1
> Host: localhost:8004
> User-Agent: curl/7.68.0
> Accept: */*
> Content-Length: 248
> Content-Type: multipart/form-data; boundary=------------------------c5e518168623729b
>
* We are completely uploaded and fine
< HTTP/1.1 302 Found
< Location: /
< Set-Cookie: session=dGrl3DxPwKJl-AbGuJ04R2bKP4o-UCtG0YJpzpihG7c; Path=/
< content-length: 0
< connection: keep-alive
< content-type: text/html; charset=utf-8
<
* Connection #0 to host localhost left intact// 2.1 empty session
$ curl -sv 'http://localhost:8004'
> GET / HTTP/1.1
> Host: localhost:8004
> User-Agent: curl/7.68.0
> Accept: */*
>
< HTTP/1.1 302 Found
< Location: /login
< content-length: 0
< connection: keep-alive
< content-type: text/html; charset=utf-8
<
* Connection #0 to host localhost left intact// 2.2 loged session
$ curl -sv 'http://localhost:8004' --cookie session=dGrl3DxPwKJl-AbGuJ04R2bKP4o-UCtG0YJpzpihG7c
> GET / HTTP/1.1
> Host: localhost:8004
> User-Agent: curl/7.68.0
> Accept: */*
> Cookie: session=dGrl3DxPwKJl-AbGuJ04R2bKP4o-UCtG0YJpzpihG7c
>
< HTTP/1.1 200 OK
< content-length: 48
< connection: keep-alive
< content-type: text/html; charset=utf-8
<
* Connection #0 to host localhost left intact
<a href="/logout">Logout</a><p>Welcome, demo</p>
pyx
1. test case
I use this examples:
2. operation result
one browser ( chrome ) logged in,
then visit '/', found all other clients (firefox or curl) was loged in.
Is this the expected effect? Am I miss some thing?
3. versions
tested on ubuntu 20.04
with