view MoinMoin/web/session.py @ 5408:4226fde63931

generate session cookie names to fix some issues (details see below) New setting cfg.cookie_name (default None). Please do not use cfg.cookie_path any more (usually should not be needed any more, we now always put path=/ into the cookie except if you explicitly configure something else). Problems addressed by this changeset: - cookies do not store the port (thus running different wikis, with different user sessions on same host, but different ports did not work) - (old) cookies with path=/ interfered with (new) cookies with path=/wiki1 To fix, we now use different cookie names (before it was MOIN_SESSION ever). Added MoinMoin.web.session.get_cookie_name() to determine the full cookie name for some software (usually 'MOIN') using it for some usage (e.g. 'SESSION') for some wiki (or group of wikis) determined by some name. We do not use the path=... information in the cookie any more, but use path=/ ever. Instead of using the cookie path, we use differently named cookies, so we get the right cookie no matter at what URL the wiki currently is "mounted". If name is None, we just use cfg.siteid, which is unique within a wiki farm created by a single farmconfig. If you only run ONE(!) wikiconfig wiki, it is also unique, of course, but not if you run multiple wikiconfig wikis under same domain. If name is not None (and not 'urlmagic'), we just use the given name (you want to use that to share stuff between several wikis - just give same name and it will use the same cookie. same thing if you don't want to share, just give a different name then [e.g. if cfg.siteid or 'urlmagic' doesn't work for you]). If name is 'urlmagic', we use some URL components to make up some name. Moving a wiki to a different URL will break all sessions. Exchanging URLs of wikis might lead to confusion (requiring the client to purge the cookies).
author Thomas Waldmann <tw AT waldmann-edv DOT de>
date Sun, 10 Jan 2010 00:17:16 +0100
parents 437558fff184
children b0c8c2f225f3
line wrap: on
line source
# -*- coding: iso-8859-1 -*-
"""
    MoinMoin - WSGI session handling

    To provide sessions, the MoinMoin WSGI application interacts with an
    object implementing the `SessionService` API. The interface is quite
    straight forward. For documentation of the expected methods, refer
    to the documentation of `SessionService` in this module.

    @copyright: 2008 MoinMoin:FlorianKrupicka,
                2009 MoinMoin:ThomasWaldmann
    @license: GNU GPL, see COPYING for details.
"""
import time

from werkzeug.contrib.sessions import FilesystemSessionStore, Session

from MoinMoin.util import filesys

from MoinMoin import log
logging = log.getLogger(__name__)

class MoinSession(Session):
    """ Compatibility interface to Werkzeug-sessions for old Moin-code. """
    is_new = property(lambda s: s.new)

class SessionService(object):
    """
    A session service returns a session object given a request object and
    provides services like persisting sessions and cleaning up occasionally.
    """
    def get_session(self, request, sid=None):
        """ Return a session object pertaining to the particular request."""
        raise NotImplementedError

    def destroy_session(self, request, session):
        """ Destroy an existing session (make it unusable). """
        raise NotImplementedError

    def finalize(self, request, session):
        """
        If the service needs to do anything to the session and/or request,
        before it is sent back to the client, he can chose to do so here.
        Typical examples would be setting cookies for the client.
        """
        raise NotImplementedError

def _get_session_lifetime(request, userobj):
    """ Get session lifetime for the user object userobj
    Cookie lifetime in hours, can be fractional. First tuple element is for anonymous sessions,
    second tuple element is for logged-in sessions. For anonymous sessions,
    t=0 means that they are disabled, t>0 means that many hours.
    For logged-in sessions, t>0 means that many hours,
    or forever if user checked 'remember_me', t<0 means -t hours and
    ignore user 'remember_me' setting - you usually don't want to use t=0, it disables logged-in sessions."""
    lifetime = int(float(request.cfg.cookie_lifetime[userobj and userobj.valid]) * 3600)
    forever = 10 * 365 * 24 * 3600 # 10 years

    if userobj and userobj.valid and userobj.remember_me and lifetime > 0:
        return forever
    return abs(lifetime)

def get_cookie_name(request, name, usage, software='MOIN'):
    """
    Determine the full cookie name for some software (usually 'MOIN') using
    it for some usage (e.g. 'SESSION') for some wiki (or group of wikis)
    determined by name.

    Note:
    -----
    We do not use the path=... information in the cookie any more, because it can
    easily cause confusion if there are multiple cookies with same name, but
    different pathes (like e.g. / and /foo).

    Instead of using the cookie path, we use differently named cookies, so we get
    the right cookie no matter at what URL the wiki currently is "mounted".

    If name is None, we just use cfg.siteid, which is unique within a wiki farm
    created by a single farmconfig. If you only run ONE(!) wikiconfig wiki, it
    is also unique, of course, but not if you run multiple wikiconfig wikis under
    same domain.

    If name is not None (and not 'urlmagic'), we just use the given name (you
    want to use that to share stuff between several wikis - just give same name
    and it will use the same cookie. same thing if you don't want to share, just
    give a different name then [e.g. if cfg.siteid or 'urlmagic' doesn't work
    for you]).

    If name is 'urlmagic', we use some URL components to make up some name.
    Moving a wiki to a different URL will break all sessions. Exchanging URLs
    of wikis might lead to confusion (requiring the client to purge the cookies).
    """
    if name is None:
        name = request.cfg.siteid  # == config name, unique per farm

    elif name == 'urlmagic':
        url_components = [
            # cookies do not store the port, thus we add it to the cookie name:
            request.environ['SERVER_PORT'],
            # we always store path=/ into cookie, thus we add the path to the name:
            ('ROOT' + request.script_root).replace('/', '_'),
        ]
        name = '_'.join(url_components)

    return "%s_%s_%s" % (software, usage, name)


class FileSessionService(SessionService):
    """
    This sample session service stores session information in a temporary
    directory and identifies the session via a cookie in the request/response
    cycle. It is based on werkzeug's FilesystemSessionStore, that implements
    the whole logic for creating the actual session objects (which are
    inherited from the builtin `dict`)
    """
    def __init__(self, cookie_usage='SESSION'):
        self.cookie_usage = cookie_usage

    def _store_get(self, request):
        path = request.cfg.session_dir
        try:
            filesys.mkdir(path)
        except OSError:
            pass
        return FilesystemSessionStore(path=path, filename_template='%s', session_class=MoinSession)

    def get_session(self, request, sid=None):
        if sid is None:
            cookie_name = get_cookie_name(request, name=request.cfg.cookie_name, usage=self.cookie_usage)
            sid = request.cookies.get(cookie_name, None)
        store = self._store_get(request)
        if sid is None:
            session = store.new()
        else:
            session = store.get(sid)
        return session

    def destroy_session(self, request, session):
        session.clear()
        store = self._store_get(request)
        store.delete(session)

    def finalize(self, request, session):
        if request.user.auth_method == 'setuid':
            userobj = request._setuid_real_user
            setuid = request.user.id
        else:
            userobj = request.user
            setuid = None
        logging.debug("finalize userobj = %r, setuid = %r" % (userobj, setuid))
        cfg = request.cfg
        # we use different cookie names for different wikis:
        cookie_name = get_cookie_name(request, name=request.cfg.cookie_name, usage=self.cookie_usage)
        # we always use path='/' except if explicitly overridden by configuration,
        # which is usually not needed and not recommended:
        cookie_path = cfg.cookie_path or '/'
        if userobj and userobj.valid:
            session['user.id'] = userobj.id
            session['user.auth_method'] = userobj.auth_method
            session['user.auth_attribs'] = userobj.auth_attribs
            if setuid:
                session['setuid'] = setuid
            elif 'setuid' in session:
                del session['setuid']
            logging.debug("after auth: storing valid user into session: %r" % userobj.name)
        else:
            logging.debug("after auth: user is invalid")
            if 'user.id' in session:
                logging.debug("after auth: destroying session: %r" % session)
                self.destroy_session(request, session)
                logging.debug("after auth: deleting session cookie!")
                request.delete_cookie(cookie_name, path=cookie_path, domain=cfg.cookie_domain)

        cookie_lifetime = _get_session_lifetime(request, userobj)
        if cookie_lifetime:
            cookie_expires = time.time() + cookie_lifetime
            # a secure cookie is not transmitted over unsecure connections:
            cookie_secure = (cfg.cookie_secure or  # True means: force secure cookies
                             cfg.cookie_secure is None and request.is_secure)  # None means: https -> secure cookie
            logging.debug("user: %r, setting session cookie: %r" % (userobj, session.sid))
            request.set_cookie(cookie_name, session.sid,
                               max_age=cookie_lifetime, expires=cookie_expires,
                               path=cookie_path, domain=cfg.cookie_domain,
                               secure=cookie_secure, httponly=cfg.cookie_httponly)

            if session.should_save:
                store = self._store_get(request)
                logging.debug("saving session: %r" % session)
                store.save(session)