settings.py
MIDDLEWARE = [
'django.contrib.sessions.middleware.SessionMiddleware',
]
1. 看看SessionMiddleware类 from django.contrib.sessions.middleware import SessionMiddleware
class SessionMiddleware(MiddlewareMixin):
#1.1
def __init__(self, get_response=None):
self.get_response = get_response
engine = import_module(settings.SESSION_ENGINE)
self.SessionStore = engine.SessionStore
#2
def process_request(self, request):
session_key = request.COOKIES.get(settings.SESSION_COOKIE_NAME)
request.session = self.SessionStore(session_key) def process_response(self, request, response):
"""
If request.session was modified, or if the configuration is to save the
session every time, save the changes and set a session cookie or delete
the session cookie if the session has been emptied.
"""
try:
accessed = request.session.accessed
modified = request.session.modified
empty = request.session.is_empty()
except AttributeError:
pass
else:
# First check if we need to delete this cookie.
# The session should be deleted only if the session is entirely empty
if settings.SESSION_COOKIE_NAME in request.COOKIES and empty:
response.delete_cookie(
settings.SESSION_COOKIE_NAME,
path=settings.SESSION_COOKIE_PATH,
domain=settings.SESSION_COOKIE_DOMAIN,
)
else:
if accessed:
patch_vary_headers(response, ('Cookie',))
if (modified or settings.SESSION_SAVE_EVERY_REQUEST) and not empty:
if request.session.get_expire_at_browser_close():
max_age = None
expires = None
else:
max_age = request.session.get_expiry_age()
expires_time = time.time() + max_age
expires = cookie_date(expires_time)
# Save the session data and refresh the client cookie.
# Skip session save for 500 responses, refs #3881.
if response.status_code != 500:
try:
request.session.save()
except UpdateError:
raise SuspiciousOperation(
"The request's session was deleted before the "
"request completed. The user may have logged "
"out in a concurrent request, for example."
)
response.set_cookie(
settings.SESSION_COOKIE_NAME,
request.session.session_key, max_age=max_age,
expires=expires, domain=settings.SESSION_COOKIE_DOMAIN,
path=settings.SESSION_COOKIE_PATH,
secure=settings.SESSION_COOKIE_SECURE or None,
httponly=settings.SESSION_COOKIE_HTTPONLY or None,
)
return response
1.1步：每个中间件的类在调用的时候都会先执行init 构造方法
class SessionMiddleware(MiddlewareMixin):
def __init__(self, get_response=None):
self.get_response = get_response
#1.1.1 到配置文件中获取一个类
engine = import_module(settings.SESSION_ENGINE)
self.SessionStore = engine.SessionStore
1.1.1步：django自带的settings中没有SESSION_ENGINE这个属性，那就需要去全局的global_settings文件中找
SESSION_ENGINE = 'django.contrib.sessions.backends.db' #这个时候self.SessionStore =db 文件中的 SessionStore类
class SessionStore(SessionBase):
"""
Implements database session store.
"""
def __init__(self, session_key=None):
super(SessionStore, self).__init__(session_key) @classmethod
def get_model_class(cls):
# Avoids a circular import and allows importing SessionStore when
# django.contrib.sessions is not in INSTALLED_APPS.
from django.contrib.sessions.models import Session
return Session @cached_property
def model(self):
return self.get_model_class() def load(self):
try:
s = self.model.objects.get(
session_key=self.session_key,
expire_date__gt=timezone.now()
)
return self.decode(s.session_data)
except (self.model.DoesNotExist, SuspiciousOperation) as e:
if isinstance(e, SuspiciousOperation):
logger = logging.getLogger('django.security.%s' % e.__class__.__name__)
logger.warning(force_text(e))
self._session_key = None
return {} def exists(self, session_key):
return self.model.objects.filter(session_key=session_key).exists() def create(self):
while True:
self._session_key = self._get_new_session_key()
try:
# Save immediately to ensure we have a unique entry in the
# database.
self.save(must_create=True)
except CreateError:
# Key wasn't unique. Try again.
continue
self.modified = True
return def create_model_instance(self, data):
"""
Return a new instance of the session model object, which represents the
current session state. Intended to be used for saving the session data
to the database.
"""
return self.model(
session_key=self._get_or_create_session_key(),
session_data=self.encode(data),
expire_date=self.get_expiry_date(),
) def save(self, must_create=False):
"""
Saves the current session data to the database. If 'must_create' is
True, a database error will be raised if the saving operation doesn't
create a *new* entry (as opposed to possibly updating an existing
entry).
"""
if self.session_key is None:
return self.create()
data = self._get_session(no_load=must_create)
obj = self.create_model_instance(data)
using = router.db_for_write(self.model, instance=obj)
try:
with transaction.atomic(using=using):
obj.save(force_insert=must_create, force_update=not must_create, using=using)
except IntegrityError:
if must_create:
raise CreateError
raise
except DatabaseError:
if not must_create:
raise UpdateError
raise def delete(self, session_key=None):
if session_key is None:
if self.session_key is None:
return
session_key = self.session_key
try:
self.model.objects.get(session_key=session_key).delete()
except self.model.DoesNotExist:
pass @classmethod
def clear_expired(cls):
cls.get_model_class().objects.filter(expire_date__lt=timezone.now()).delete()
SessionStore类
2.这时候就该走中间件的process_request方法了
def process_request(self, request):
session_key = request.COOKIES.get(settings.SESSION_COOKIE_NAME) #从cookies中获取 'sessionid' 对应的值
request.session = self.SessionStore(session_key) #把获取的值给db中的SessionStore类进行实例化并赋值给request.session
class SessionStore(SessionBase):
def __init__(self, session_key=None):
super(SessionStore, self).__init__(session_key) #调用父类的 init 构造方
class SessionBase(object):
session_key = property(_get_session_key)
_session_key = property(_get_session_key, _set_session_key) #在代码加载的时候要类的字段在方法前面加载，这时绑定了property方法，如果是获取操作就走_get_session_key方法，设置操作就走_set_session_key方法
def __init__(self, session_key=None):
#2.1
self._session_key = session_key #给_session_key赋值，走_set_session_key方法，把session_key传进去
self.accessed = False
self.modified = False
self.serializer = import_string(settings.SESSION_SERIALIZER) #SESSION_SERIALIZER = 'django.contrib.sessions.serializers.JSONSerializer'
#表示 django 的session中间件是用Json进行序列化
2.1步：
class SessionBase(object):
def _set_session_key(self, value): if self._validate_session_key(value): #value = None
self.__session_key = value
else:
self.__session_key = None def _validate_session_key(self, key):
#如果sessionid有值并且长度大于等于8
return key and len(key) >= 8
3. 然后该走视图中 对request.session进行操作，如果对session就行设置 值就执行 SessionStore 类中的__setitem__方法，如果是取session中的值就执行 __getitem__方法，删除执行__delitem__方法
，但是在SessionStore类中没有发现这个方法，那就去它的父类中找
class SessionBase(object):
#self 是 request.session 这个SessionBase类对象
def __getitem__(self, key):
return self._session[key] #到字典中获取值 def __setitem__(self, key, value):
self._session[key] = value #给字典设置值，并且改变modified 状态为 True
self.modified = True def __delitem__(self, key):
del self._session[key] #删除字典中的键值对，并且改变modified 状态为 True
self.modified = True
在上面的代码中，我们看到self._session，点进去看看
class SessionBase(object):
_session = property(_get_session)
class SessionBase(object):
#self 是 request.session 这个SessionBase类对象
def _get_session(self, no_load=False): self.accessed = True #在这步给session设置值的时候 把这个accessed 状态改成了 True
try:
return self._session_cache # 获取self 的_session_cache 属性，如果没有就走下面的except方法
except AttributeError:
if self.session_key is None or no_load:
self._session_cache = {} #赋值操作
else:
self._session_cache = self.load()
return self._session_cache
4. 走中间件的process_response 方法
class SessionMiddleware(MiddlewareMixin):
def process_response(self, request, response): try:
accessed = request.session.accessed # TRUE
modified = request.session.modified #当设置或删除操作时 为TRUE
#4.1
empty = request.session.is_empty() # Flase
except AttributeError:
pass
else:
# 4.2 如果sessionid在cookies中 并且值为空，从cookie中把sessionid键值删除
if settings.SESSION_COOKIE_NAME in request.COOKIES and empty:
response.delete_cookie(
settings.SESSION_COOKIE_NAME,
path=settings.SESSION_COOKIE_PATH,
domain=settings.SESSION_COOKIE_DOMAIN,
)
else:if accessed:
patch_vary_headers(response, ('Cookie',))
4.3 有效期和 过期时间相关
if (modified or settings.SESSION_SAVE_EVERY_REQUEST) and not empty: #True and True
#在浏览器关闭的时候 session 的有效期为 None ， 过期时间 为 None
if request.session.get_expire_at_browser_close():
max_age = None
expires = None
else:
# 设置 有效期 和 过期时间
max_age = request.session.get_expiry_age()
expires_time = time.time() + max_age
expires = cookie_date(expires_time)
# Save the session data and refresh the client cookie.
# Skip session save for 500 responses, refs #3881.
if response.status_code != 500:
try:
#4.4 访问正常
request.session.save()
except UpdateError:
raise SuspiciousOperation(
"The request's session was deleted before the "
"request completed. The user may have logged "
"out in a concurrent request, for example."
)
#4.5 对 response 设置 cookie
response.set_cookie(
settings.SESSION_COOKIE_NAME,
request.session.session_key, max_age=max_age,
expires=expires, domain=settings.SESSION_COOKIE_DOMAIN,
path=settings.SESSION_COOKIE_PATH,
secure=settings.SESSION_COOKIE_SECURE or None,
httponly=settings.SESSION_COOKIE_HTTPONLY or None,
)
return response
4.1步：
class SessionBase(object):
def is_empty(self):
"Returns True when there is no session_key and the session is empty"
try:
return not bool(self._session_key) and not self._session_cache # 获取_session_key 执行property(_get_session_key)方法
# 此时 self._session_cache 中已经有值了
# True and Flase
except AttributeError:
return True
class SessionBase(object):
def _get_session_key(self):
return self.__session_key #从2.1步可以得出 为None
4.4步：
class SessionStore(SessionBase):
def save(self, must_create=False):
#4.4.1
if self.session_key is None: return self.create() data = self._get_session(no_load=must_create)
obj = self.create_model_instance(data)
using = router.db_for_write(self.model, instance=obj)
try:
with transaction.atomic(using=using):
obj.save(force_insert=must_create, force_update=not must_create, using=using)
except IntegrityError:
if must_create:
raise CreateError
raise
except DatabaseError:
if not must_create:
raise UpdateError
raise
4.4.1步：
#session_key 获取，执行session_key = property(_get_session_key) _get 方法 class SessionBase(object):
def _get_session_key(self):
return self.__session_key # None
执行 self.create() 方法
class SessionStore(SessionBase):
def create(self):
while True:
#4.4.1.1
self._session_key = self._get_new_session_key() #对_session_key 赋值操作，执行_set 方法
try:
#4.4.1.2 传参 must_create=True
self.save(must_create=True)
except CreateError:
# Key wasn't unique. Try again.
continue
self.modified = True
return
4.4.1.1步：
class SessionBase(object):
def _get_new_session_key(self):
while True:
session_key = get_random_string(32, VALID_KEY_CHARS)
if not self.exists(session_key):
break
return session_key #随机字符串
class SessionBase(object):
def _set_session_key(self, value): if self._validate_session_key(value): #此时 value 是一个随机字符串
self.__session_key = value #self.__session_key 是 一个随机字符串
else:
self.__session_key = None
4.4.1.2步：
class SessionStore(SessionBase):
def save(self, must_create=False): if self.session_key is None: #获取session_key 操作，执行_get方法 见下面
return self.create()
data = self._get_session(no_load=must_create) #must_create =True 见下面
obj = self.create_model_instance(data) #django创建session表对象
using = router.db_for_write(self.model, instance=obj)
try:
with transaction.atomic(using=using):
# session对象 执行save方法 参数must_create = True 表示是创建 一条数据
obj.save(force_insert=must_create, force_update=not must_create, using=using)
except IntegrityError:
if must_create:
raise CreateError
raise
except DatabaseError:
if not must_create:
raise UpdateError
raise class SessionBase(object): session_key = property(_get_session_key) def _get_session_key(self):
return self.__session_key #此时是一个随机字符串 class SessionBase(object):
def _get_session(self, no_load=False): self.accessed = True
try:
return self._session_cache #此时 字典中已经有值
except AttributeError:
if self.session_key is None or no_load:
self._session_cache = {}
else:
self._session_cache = self.load()
return self._session_cache
