python - Django 请求有时不包含通过 SSL 的 session

Question

我在我的 Django 网络应用程序中遇到了一些奇怪的事情，我在数据库上使用 session 来跟踪用户 session ，但似乎通过 SSL 这些 session 不会持续存在，我没有太多原因的线索，但我有证据证明它是如何发生的。

我的主要问题是，我认为如果您已登录，它会将您重定向到索引，而在索引中，如果您未登录，则会将您重定向到登录屏幕，所以会发生什么这是登录后，服务器将我重定向到索引页面，但索引将得到“无”检查 session 中的登录参数，然后，在登录表单上它再次检查 session 并且它实际上得到用户登录，所以我进入无限重定向循环，过了一会儿 chrome 说页面重定向次数太多。

这是我的settings.py

"""
Django settings for rienpaAdmin project.

Generated by 'django-admin startproject' using Django 2.2.6.

For more information on this file, see
https://docs.djangoproject.com/en/2.2/topics/settings/

For the full list of settings and their values, see
https://docs.djangoproject.com/en/2.2/ref/settings/
"""

import os

# Build paths inside the project like this: os.path.join(BASE_DIR, ...)
BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))


# Quick-start development settings - unsuitable for production
# See https://docs.djangoproject.com/en/2.2/howto/deployment/checklist/

# SECURITY WARNING: keep the secret key used in production secret!
SECRET_KEY = 'SecretKey'

# SECURITY WARNING: don't run with debug turned on in production!
DEBUG = False

ALLOWED_HOSTS = ['lodugo.com', 'www.lodugo.com']


# Application definition

INSTALLED_APPS = [
    'django.contrib.admin',
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.messages',
    'django.contrib.staticfiles',
    'main.apps.MainConfig',
]

MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
]

ROOT_URLCONF = 'rienpaAdmin.urls'

TEMPLATES = [
    {
        'BACKEND': 'django.template.backends.django.DjangoTemplates',
        'DIRS': [],
        'APP_DIRS': True,
        'OPTIONS': {
            'context_processors': [
                'django.template.context_processors.debug',
                'django.template.context_processors.request',
                'django.contrib.auth.context_processors.auth',
                'django.contrib.messages.context_processors.messages',
            ],
        },
    },
]

SESSION_ENGINE = 'django.contrib.sessions.backends.cached_db'
SESSION_COOKIE_DOMAIN = 'lodugo.com'
SESSION_COOKIE_SECURE = True
SESSION_SAVE_EVERY_REQUEST = True
SESSION_COOKIE_NAME = 'lodugo'
CSRF_COOKIE_SECURE = True
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
SECURE_HSTS_SECONDS = 15552000
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_HSTS_PRELOAD = True
X_FRAME_OPTIONS = "DENY"
SESSION_COOKIE_AGE=7776000
SESSION_EXPIRE_AT_BROWSER_CLOSE=False



WSGI_APPLICATION = 'rienpaAdmin.wsgi.application'


# Database
# https://docs.djangoproject.com/en/2.2/ref/settings/#databases

DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.postgresql_psycopg2',
        'NAME': 'DatabaseName',
        'USER': 'USER',
        'PASSWORD': 'PASSWORD',
        'HOST': 'localhost',
        'PORT': '',
    }
}


# Password validation
# https://docs.djangoproject.com/en/2.2/ref/settings/#auth-password-validators

AUTH_PASSWORD_VALIDATORS = [
    {
        'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',
    },
    {
        'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',
    },
    {
        'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator',
    },
    {
        'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',
    },
]


# Internationalization
# https://docs.djangoproject.com/en/2.2/topics/i18n/

LANGUAGE_CODE = 'en-us'

TIME_ZONE = 'UTC'

USE_I18N = True

USE_L10N = True

USE_TZ = True


# Static files (CSS, JavaScript, Images)
# https://docs.djangoproject.com/en/2.2/howto/static-files/

STATIC_URL = '/static/'

这是我的views.py

def app_admin(request: HttpRequest) -> HttpResponse:
    if (request.session.get('logged_in', False)) is not True:
        authentication = "false"
        if request.method == "POST":
            post: QueryDict = request.POST
            firebase_manager = FirebaseManager()
            result = firebase_manager.user_login(post.get('email'), post.get('password'))
            if result:
                messages.success(request, "Ingreso correcto")
                request.session['firebase_session'] = firebase_manager.save_session()
                authentication = "true"
            elif firebase_manager.error_message == "EMAIL_NOT_FOUND":
                messages.error(request, "Error: Esta cuenta no existe")
            elif firebase_manager.error_message == "INVALID_PASSWORD":
                messages.error(request, "Error: Contraseña incorrecta")
            else:
                messages.error(request, "Error: Ocurrio un error inesperado," +
                               " por favor intentalo de nuevo")
        return render(request,
                      "main/login.html",
                      context={"auth": authentication})
    return redirect("main:index")

def load_user(request: HttpRequest) -> HttpResponse:
    if request.method == "POST":
        firebase_manager = FirebaseManager()
        firebase_manager.load_session(request.session['firebase_session'])
        user_data = firebase_manager.user_data()
        request.session['user_data'] = user_data
        request.session['logged_in'] = 'true'
        return HttpResponse("Done")
    raise Http404

def index(request: HttpRequest) -> HttpResponse:
    chart_ready = "true"
    if request.session.get('logged_in', False) is True:
        user = User()
        user.load_data(request.session['user_data'])
        return render(request, "main/admin_main_screen.html", context={"user": user, "chart_ready": chart_ready})
    return redirect("main:appadmin")

def logout(request: HttpRequest) -> HttpResponse:
    if request.method == "POST":
        del request.session['user_data']
        del request.session['logged_in']
        del request.session['firebase_session']
        request.session.clear()
        request.session.flush()
        return HttpResponse("Done")
    raise Http404

其中app_admin方法是我的登录表单，index是我的索引。

我检查了 session 中“logged_in”键的输出，输出是:

None #First load of the login form
None #Second load over the POST method
None #Result over the Index page after redirected with AJAX
True #Result from login form after being redirected
None #Result from index, not getting the session
True #Result from login again, redirects again to index
None #Result over index, redirects again to login

如您所见，我的项目是在 Django 2.2 上创建的，但我使用的是 Django 3.0，而且我还使用 posgreSQL 作为数据库。在我的 HTTP 开发服务器上，这完美地工作

编辑:我测试了输出另一个 session key ，例如“firebase_session” key ，似乎我总是得到正确的值，无论如何，但“logged_in”不是这种情况，这是一个很好的线索，但仍然需要帮助弄清楚发生了什么

EDIT2:我没有使用 session key “user_data”进行测试，因为它是一个 JSON 作为 firebase_session key ，但是，这个 user_data 有时也没有，只有 firebase_session 一直存在，我真的不知道为什么

Answer 1

搞定了。仔细阅读有关缓存 session 的文档(here)，您会发现一个警告，它阐明了缓存数据库 session 和只是数据库 session 是不一样的，而且，它还有一个警告说本地缓存 session 不是多-过程安全，不利于生产，引用如下:

Warning

You should only use cache-based sessions if you’re using the Memcached cache backend. The local-memory cache backend doesn’t retain data long enough to be a good choice, and it’ll be faster to use file or database sessions directly instead of sending everything through the file or database cache backends. Additionally, the local-memory cache backend is NOT multi-process safe, therefore probably not a good choice for production environments.

感谢这个提示，我在 settings.py 上更改了我的 session 类型:

'django.contrib.sessions.backends.cached_db'

到

'django.contrib.sessions.backends.db'

一切都很完美。这没有使用 memcached 后端，这似乎是 Django 的最佳方法，因为它使用物理内存，我将在未来尝试，因为这是正确使用 cached_db 后端的正确方法。