Session3: Persistent Session Management for Quixote 3.0

Introduction

Quixote is a Python Web application framework. It comes with an in-memory session manager, which works but is incompatible with multi-process servers (SCGI, CGI, etc). It also forgets the sessions when the Publisher quits. Session3 solves these problems by providing a new session manager class and a simple back-end storage API. Session3 is based upon the previous Session2 code (for, unsurprisingly, Quixote 2).

Session3 version 3.0.0 provides a fully functional1 persistent storage

back-end for use with Quixote 3.0.0 (also see Road-map below, for later version notes):-

DirectorySessionStore

Store each pickled session in a file in the designated directory. The filename is the session ID. Uses fcntl file locking.

DirectorySessionStore(directory)

This package includes a refactored SessionManager that makes it easy to develop additional back ends, and a simplified Session class (no .is_dirty method). It supports the usual .user, .set_user() and .has_info() attributes, and you can also set your own attributes which will be saved.

It’s quite likely that the session stores can be adapted for use with other Web frameworks; let us know if you do this so we can link to you and / or include helpful code in the package.

Getting Session3

Download the latest version here: http://www.file-away.co.uk/session3/dist/session3-3.0.0.tar.gz

Using session3

You need a store, a manager and then you need to tell Quixote’s publisher to use them both: in your create_publisher function, place the following code:

# create the session store.
from session3.store.DirectorySessionStore import DirectorySessionStore
from session3.SessionManager import SessionManager

# create the session manager.
store = DirectorySessionStore(path.expanduser(some_location), create=True)
session_manager = SessionManager(store)

# create the publisher.
from quixote.publish import Publisher
publisher = Publisher(..., session_manager.session_manager)

Each session store has different initialization requirements:1 see the API documentation or the literate programming documentation for more information.

Features

All session stores have the following methods, which are called by the session manager:-

.load_session, .save_session, .delete_session, .has_session.

They also have these convenience methods:-

.setup():

initializes the store.

.delete_old_sessions(minutes):

deletes sessions that haven’t been modified for N minutes. This is meant for your application maintenance program; e.g., a daily cron job.

.iter_sessions():

Return an iterable of (id, session) for all sessions in the store. This is for admin applications that want to browse the sessions. The DirectorySession will raise a NotImplementedError3.

All stores have .is_multiprocess_safe and .is_thread_safe attributes. An application can check these flags and abort if configured inappropriately. The flags are defined as follows:-

• DirectorySessionStore is multiprocess safe because it uses fcntl file locking. This limits its use to POSIX. See the fcntl caution below. It may be thread safe because it always locks-unlocks within the same method, but we don’t know for sure so the attribute is false.1

$ test_session2.py directory