Keep Django session data after sign-in?

Question

I recently wrote shopping cart code that depends on the Session object. It seemed the reasonable way to store data for anonymous users.

While doing a bunch of testing, I ran into an annoying problem--when users sign in part way through the checkout process (or simply while browsing for other products), Django issues a new session_key and I lose access to my session data.

Is there a way to keep the old session data? Or is my design approach wrong?

Answer 1

Try writing your own SessionBackend that inherits from existing one and overrides the cycle_key method.

1 In your settings.py:

SESSION_ENGINE = 'my_app.session_backend'

2 my_app.session_backend.py:

from django.contrib.sessions.backends.db import SessionStore as DbSessionStore

class SessionStore(DbSessionStore):
    def cycle_key(self):
        pass

cycle_key is beeing called in login view after authentication.

Let me now if it works ;)

Answer 2

Instead of disabling the cycle_key() (which is a security measure to avoid session fixation vulnerabilities), you could consider restoring the values through a decorator at the login and logout views. See:

https://stackoverflow.com/a/41849076/146289