Changeset 2062

Timestamp:

11/01/08 14:49:57

Author:

fumanchu

Message:

Fix for #870 (Support "session cookies" which flush on browser close).

Files:

• trunk/cherrypy/lib/sessions.py (modified) (4 diffs)
• trunk/cherrypy/test/test_session.py (modified) (3 diffs)

trunk/cherrypy/lib/sessions.py

@@ -582 +582 @@
-
-def init(storage_type='ram', path=None, path_header=None, name='session_id',
-
+
+
-    """Initialize session object (using cookies).
-    
@@ -592 +593 @@
-        cookie 'path' will be pulled from request.headers[path_header].
-    name: the name of the cookie.
-
-
+
+
+
-    domain: the cookie domain.
-    secure: if False (the default) the cookie 'secure' value will not
-        be set. If True, the cookie 'secure' value will be set (to 1).
-    clean_freq (minutes): the poll rate for expired session cleanup.
+    persistent: if True (the default), the 'timeout' argument will be used
+        to expire the cookie. If False, the cookie will not have an expiry,
+        and the cookie will be a "session cookie" which expires when the
+        browser is closed.
-    
-    Any additional kwargs will be bound to the new Session instance,
@@ -638 +644 @@
-        cherrypy.session = cherrypy._ThreadLocalProxy('session')
-    
+    if persistent:
+        cookie_timeout = timeout
+    else:
+        # See http://support.microsoft.com/kb/223799/EN-US/
+        # and http://support.mozilla.com/en-US/kb/Cookies
+        cookie_timeout = None
-    set_response_cookie(path=path, path_header=path_header, name=name,
-
+cookie_
-
-
@@ -650 +662 @@
-        cookie 'path' will be pulled from request.headers[path_header].
-    name: the name of the cookie.
-
+
+
+
-    domain: the cookie domain.
-    secure: if False (the default) the cookie 'secure' value will not

trunk/cherrypy/test/test_session.py

@@ -100 +100 @@
-            return str(len(cherrypy.session))
-        length.exposed = True
+        
+        def session_cookie(self):
+            cherrypy.session.load()
+            return cherrypy.session.id
+        session_cookie.exposed = True
+        session_cookie._cp_config = {
+            'tools.sessions.path': '/session_cookie',
+            'tools.sessions.name': 'temp',
+            'tools.sessions.persistent': False}
-    
-    cherrypy.tree.mount(Root())
@@ -121 +130 @@
-        self.getPage('/testStr')
-        self.assertBody('1')
+        cookie_parts = dict([p.strip().split('=')
+                             for p in self.cookies[0][1].split(";")])
+        # Assert there is an 'expires' param
+        self.assertEqual(set(cookie_parts.keys()),
+                         set(['session_id', 'expires', 'Path']))
-        self.getPage('/testGen', self.cookies)
-        self.assertBody('2')
@@ -276 +290 @@
-        self.assertNotEqual(id1, id2)
-        self.assertNotEqual(id2, 'maliciousid')
+    
+    def test_7_session_cookies(self):
+        self.getPage('/setsessiontype/ram')
+        self.getPage('/session_cookie')
+        # grab the cookie ID
+        cookie_parts = dict([p.strip().split('=') for p in self.cookies[0][1].split(";")])
+        # Assert there is no 'expires' param
+        self.assertEqual(set(cookie_parts.keys()), set(['temp', 'Path']))
+        id1 = cookie_parts['temp']
+        self.assertEqual(sessions.RamSession.cache.keys(), [id1])
+        
+        # Send another request in the same "browser session".
+        self.getPage('/session_cookie', self.cookies)
+        cookie_parts = dict([p.strip().split('=') for p in self.cookies[0][1].split(";")])
+        # Assert there is no 'expires' param
+        self.assertEqual(set(cookie_parts.keys()), set(['temp', 'Path']))
+        self.assertBody(id1)
+        self.assertEqual(sessions.RamSession.cache.keys(), [id1])
+        
+        # Wait 0.5 seconds to separate the two sessions
+        time.sleep(0.5)
+        
+        # Simulate a browser close by just not sending the cookies
+        self.getPage('/session_cookie')
+        # grab the cookie ID
+        cookie_parts = dict([p.strip().split('=') for p in self.cookies[0][1].split(";")])
+        # Assert there is no 'expires' param
+        self.assertEqual(set(cookie_parts.keys()), set(['temp', 'Path']))
+        # Assert a new id has been generated...
+        id2 = cookie_parts['temp']
+        self.assertNotEqual(id1, id2)
+        self.assertEqual(set(sessions.RamSession.cache.keys()), set([id1, id2]))
+        # Wait for the session.timeout on the first session (1 second)
+        time.sleep(1)
+        cache = sessions.RamSession.cache.keys()
+        if cache != [id2]:
+            if set(cache) == set([id1, id2]):
+                self.fail("The first session did not time out.")
+            elif not cache:
+                self.fail("The second session may have been cleaned up "
+                          "prematurely, but it may just be thread timing.")
+            else:
+                self.fail("Unknown session id in cache: %r", cache)
+        # Wait for the session.timeout on the second session (1 second)
+        time.sleep(1)
+        cache = sessions.RamSession.cache.keys()
+        if cache:
+            if cache == [id2]:
+                self.fail("The second session did not time out.")
+            else:
+                self.fail("Unknown session id in cache: %r", cache)
-
-