Django的session模块（一）模型与存储

Django Session Model

Django的session是一个非常简单的模型，session的抽象模型定义在django/contrib/sessions/base_sessiion.py中：

from django.db import models
from django.utils.translation import gettext_lazy as _


class BaseSessionManager(models.Manager):
    def encode(self, session_dict):
        """
        Return the given session dictionary serialized and encoded as a string.
        """
        session_store_class = self.model.get_session_store_class()
        return session_store_class().encode(session_dict)

    def save(self, session_key, session_dict, expire_date):
        s = self.model(session_key, self.encode(session_dict), expire_date)
        if session_dict:
            s.save()
        else:
            s.delete()  # Clear sessions with no data.
        return s


class AbstractBaseSession(models.Model):
    session_key = models.CharField(_('session key'), max_length=40, primary_key=True)
    session_data = models.TextField(_('session data'))
    expire_date = models.DateTimeField(_('expire date'), db_index=True)

    objects = BaseSessionManager()

    class Meta:
        abstract = True
        verbose_name = _('session')
        verbose_name_plural = _('sessions')

    def __str__(self):
        return self.session_key

    @classmethod
    def get_session_store_class(cls):
        raise NotImplementedError

    def get_decoded(self):
        session_store_class = self.get_session_store_class()
        return session_store_class().decode(self.session_data)

上面分别定义了session的抽象模型和模型对象(objects)的管理方法。模型包含session_key、session_data和expire_data三个字段。管理方法中新增了encode方法，重定义了save方法。其中encode方法会调用实际session模型类的get_session_store_class方法返回对象encode方法，将收到的session字典序列为字符串，这一方法在抽象类中没有定义，会在实际模型类中定义。save方法接受模型所需字段，构成临时对象，只有session_dict字段不为空时，才会调用模型的save()方法存入数据库，否则删除临时对象。
实际使用的session模型类定义在django/contrib/sessions/models.py中：

from django.contrib.sessions.base_session import (
    AbstractBaseSession, BaseSessionManager,
)


class SessionManager(BaseSessionManager):
    use_in_migrations = True


class Session(AbstractBaseSession):
    """
    Django provides full support for anonymous sessions. The session
    framework lets you store and retrieve arbitrary data on a
    per-site-visitor basis. It stores data on the server side and
    abstracts the sending and receiving of cookies. Cookies contain a
    session ID -- not the data itself.

    The Django sessions framework is entirely cookie-based. It does
    not fall back to putting session IDs in URLs. This is an intentional
    design decision. Not only does that behavior make URLs ugly, it makes
    your site vulnerable to session-ID theft via the "Referer" header.

    For complete documentation on using Sessions in your code, consult
    the sessions documentation that is shipped with Django (also available
    on the Django Web site).
    """
    objects = SessionManager()

    @classmethod
    def get_session_store_class(cls):
        from django.contrib.sessions.backends.db import SessionStore
        return SessionStore

    class Meta(AbstractBaseSession.Meta):
        db_table = 'django_session'

实际使用的session模型的字段继承自上文定义的抽象模型，将模型管理对象的use_in_migrations属性改为True，这一属性定义在Django默认的模型管理类的基类django/db/models/manage.pyBaseManage中，表示当前模型是否会被数据库迁移操作影响。并且覆盖了抽象类的get_session_store_class方法，这一方法会返回Django/Contrib/session/backends/db中定义的SessionStore类。同时显示的定义了session数据表的名字django_session。
get_session_store_class方法返回的SessionStore类继承自django/contrib/sessions/backends/base.py中的SessionBase，定义如下：

import base64
import logging
import string
import warnings
from datetime import datetime, timedelta

from django.conf import settings
from django.contrib.sessions.exceptions import SuspiciousSession
from django.core.exceptions import SuspiciousOperation
from django.utils import timezone
from django