core.session

Module Contents

Classes

Session	Store Sessions inside the datastore.
DeleteSessionsIter	QueryIter to delete all session entities encountered.

Functions

killSessionByUser([user])	Invalidates all active sessions for the given user.
start_clear_sessions()	Removes old (expired) Sessions

Attributes

_SENTINEL
TObserver	Type of the observer for Session.on_delete()

core.session._SENTINEL: Final[object]

core.session.TObserver

Type of the observer for Session.on_delete()

class core.session.Session

Bases: viur.core.db.Entity

Store Sessions inside the datastore. The behaviour of this module can be customized in the following ways:

• :prop:same_site can be set to None, “none”, “lax” or “strict” to influence the same-site tag on the cookies

  we set

• :prop:use_session_cookie is set to True by default, causing the cookie to be treated as a session cookie

  (it will be deleted on browser close). If set to False, it will be emitted with the life-time in conf.user.session_life_time.

• The config variable conf.user.session_life_time: Determines, how long (in seconds) a session is valid.

  Even if :prop:use_session_cookie is set to True, the session is voided server-side after no request has been made within the configured lifetime.

• The config variables conf.user.session_persistent_fields_on_login and

  conf.user.session_persistent_fields_on_logout lists fields, that may survive a login/logout action. For security reasons, we completely destroy a session on login/logout (it will be deleted, a new empty database object will be created and a new cookie with a different key is sent to the browser). This causes all data currently stored to be lost. Only keys listed in these variables will be copied into the new session.

kindName = 'viur-session'

same_site = 'lax'

use_session_cookie = True

cookie_name

GUEST_USER = '__guest__'

_ON_DELETE_OBSERVER = []

load()

Initializes the Session.

If the client supplied a valid Cookie, the session is read from the datastore, otherwise a new, empty session will be initialized.

save()

Writes the session into the database.

Does nothing, in case the session hasn’t been changed in the current request.

__setitem__(key, item)

Stores a new value under the given key.

If that key exists before, its value is overwritten.

Parameters:

• key (str) –

• item (Any) –

markChanged()

Explicitly mark the current session as changed. This will force save() to write into the datastore, even if it believes that this session hasn’t changed.

Return type:

None

reset()

Invalidates the current session and starts a new one.

This function is especially useful at login, where we might need to create an SSL-capable session.

Warning:

Everything is flushed.

Return type:

None

__delitem__(key)

Removes a key from the session. This key must exist.

Parameters:

key (str) –

Return type:

None

__ior__(other)

Merges the contents of a dict into the session.

Parameters:

other (dict) –

Return type:

Self

update(other)

Merges the contents of a dict into the session.

Parameters:

other (dict) –

Return type:

None

pop(key, default=_SENTINEL)

Delete a specified key from the session.

If key is in the session, remove it and return its value, else return default. If default is not given and key is not in the session, a KeyError is raised.

Parameters:

key (str) –

Return type:

Any

clear()

Return type:

None

popitem()

Return type:

Tuple[Any, Any]

setdefault(key, default=None)

Return type:

Any

classmethod on_delete(func, /)

Decorator to register an observer for the _session delete event_.

Parameters:

func (TObserver) –

Return type:

TObserver

classmethod dispatch_on_delete(entry)

Call the observers for the _session delete event_.

Parameters:

entry (viur.core.db.Entity) –

Return type:

None

class core.session.DeleteSessionsIter

Bases: viur.core.tasks.DeleteEntitiesIter

QueryIter to delete all session entities encountered.

Each deleted entity triggers a _session delete event_ which is dispatched by Session.dispatch_on_delete().

classmethod handleEntry(entry, customData)

Overridable hook to process one entry. “entry” will be either an db.Entity or an SkeletonInstance (if that query has been created by skel.all())

Warning: If your query has an sortOrder other than __key__ and you modify that property here it is possible to encounter that object later one again (as it may jump behind the current cursor).

Parameters:

• entry (viur.core.db.Entity) –

• customData (Any) –

Return type:

None

core.session.killSessionByUser(user=None)

Invalidates all active sessions for the given user.

This means that this user is instantly logged out. If no user is given, it tries to invalidate all active sessions.

Use “__guest__” to kill all sessions not associated with a user.

Parameters:

user (Optional[Union[str, viur.core.db.Key, None]]) – UserID, “__guest__” or None.

core.session.start_clear_sessions()

Removes old (expired) Sessions