SessionMiddleware
browser sends a Cookie comprising SESSION_COOKIE_NAME
middleware django_session from the withdrawn deposit according SESSION_COOKIE_NAME session,
set the session attribute of the request (SessionStore), comprising _auth_user_id, _auth_user_backend, _auth_user_hash other
synchronization session and return response back to the browser the cookie status
Source:
class SessionMiddleware(MiddlewareMixin): def __init__(self, get_response=None): #初始化session,django启动时执行一次 self.get_response = get_response engine = import_module(settings.SESSION_ENGINE) self.SessionStore = engine.SessionStore def process_request(self, request): session_key = request.COOKIES.get(settings.SESSION_COOKIE_NAME) #从cookie中读取sessionkey request.session = self.SessionStore(session_key) #根据sessionkey从django_session中读取session def process_response(self, request, response): """ If request.session was modified, or if the configuration is to save the session every time, save the changes and set a session cookie or delete the session cookie if the session has been emptied. """ try: accessed = request.session.accessed modified = request.session.modified empty = request.session.is_empty() except AttributeError: pass else: # First check if we need to delete this cookie. # The session should be deleted only if the session is entirely empty # 如果cookie有sessionid并且请求中session是空的,将cookie中的session置空 if settings.SESSION_COOKIE_NAME in request.COOKIES and empty: response.delete_cookie( settings.SESSION_COOKIE_NAME, path=settings.SESSION_COOKIE_PATH, domain=settings.SESSION_COOKIE_DOMAIN, ) else: if accessed: patch_vary_headers(response, ('Cookie',)) # If you changed session and the session is not empty in the request, save session data, and update the cookie returned (except the return status 500) IF (Modified or settings.SESSION_SAVE_EVERY_REQUEST) and not empty: IF request.session.get_expire_at_browser_close ( ): the max_age = None Expires = None the else : the max_age = request.session.get_expiry_age () expires_time = the time.time () + the max_age Expires = http_date(expires_time) # Save the session data and refresh the client cookie. # Skip session save for 500 responses, refs #3881. if response.status_code != 500: try: request.session.save() except UpdateError: raise SuspiciousOperation( "The request's session was deleted before the " "request completed. The user may have logged " "out in a concurrent request, for example." ) response.set_cookie( settings.SESSION_COOKIE_NAME, request.session.session_key, max_age=max_age, expires=expires, domain=settings.SESSION_COOKIE_DOMAIN, path=settings.SESSION_COOKIE_PATH, secure=settings.SESSION_COOKIE_SECURE or None, httponly=settings.SESSION_COOKIE_HTTPONLY or None, samesite=settings.SESSION_COOKIE_SAMESITE, ) return response