django - 使用login()会丢失 session 数据

Question

session 何时创建和销毁？在我的应用程序中我有

def app_login(request):
    request.session.set_expiry(0)
    if 'current_day' not in request.session:
        request.session['current_day'] = Utilities.default_day()

然后我使用:

     login(request, user)

如果我以用户身份登录，则效果很好，并且“current_day”会保留在 session 中。但是，如果我以该用户身份注销并以另一个用户身份登录，那么“current_day”就会丢失，并且在调用 login() 后无法立即使用。

我认为

logout(request)

不会清除 session ，并且当第二个用户尝试登录时，数据“current_'day”在 session 中仍然可用，但调用登录(用户)可能会创建一个新 session 。

这个假设是否正确以及如何最好地纠正这个问题？

Answer 1

login source :

def login(request, user):
    """
    Persist a user id and a backend in the request. This way a user doesn't
    have to reauthenticate on every request. Note that data set during
    the anonymous session is retained when the user logs in.
    """
    if user is None:
        user = request.user
    # TODO: It would be nice to support different login methods, like signed cookies.
    if SESSION_KEY in request.session:
        if request.session[SESSION_KEY] != user.pk:
            # To avoid reusing another user's session, create a new, empty
            # session if the existing session corresponds to a different
            # authenticated user.
            request.session.flush()
    else:
        request.session.cycle_key()
    request.session[SESSION_KEY] = user.pk
    request.session[BACKEND_SESSION_KEY] = user.backend
    if hasattr(request, 'user'):
        request.user = user
    user_logged_in.send(sender=user.__class__, request=request, user=user)

保留匿名 session (它们没有 SESSION_KEY)，以不同用户刷新 session 的方式重新登录。

注销也会刷新 session :

def logout(request):
    """
    Removes the authenticated user's ID from the request and flushes their
    session data.
    """
    # Dispatch the signal before the user is logged out so the receivers have a
    # chance to find out *who* logged out.
    user = getattr(request, 'user', None)
    if hasattr(user, 'is_authenticated') and not user.is_authenticated():
        user = None
    user_logged_out.send(sender=user.__class__, request=request, user=user)

    request.session.flush()
    if hasattr(request, 'user'):
        from django.contrib.auth.models import AnonymousUser
        request.user = AnonymousUser()

这是刷新 session 的唯一两种情况。

 

您应该在登录后设置current_day(或使用自定义中间件检查每个请求是否存在)。