Skip to content

Latest commit

 

History

History
155 lines (109 loc) · 6.02 KB

README.md

File metadata and controls

155 lines (109 loc) · 6.02 KB
Raw

Flask Multiple Sessions Interface

Combine multiple sessions with different backends

With Flask Session Plus you can use multiple different backends and choose what session variables are saved on what backend.

Python version:

It works on python >= 3.4 For the moment it should work on python 2.7 but it is not tested yet. If something does not work properly please open a bug report.

Install it with:

pip install flask-session-plus

For Flask Multi Session to work, all you have to do is define all your sessions on a simple configuration variable called SESSION_CONFIG, and init the extension.

Session Configuration Example:
# example using the Google Firestore backend
from google.cloud import firestore

SESSION_CONFIG = [
    # First session will store the csrf_token only on it's own cookie.
    {
        'cookie_name': 'csrf',
        'session_type': 'secure_cookie',
        'session_fields': ['csrf_token'],
    },
    # Second session will store the user logged in inside the firestore sessions collection.
    {
        'cookie_name': 'session',
        'session_type': 'firestore',
        'session_fields': ['user_id', 'user_data'],
        'client': firestore.Client(),
        'collection': 'sessions',
    },
    # Third session will store any other values set on the Flask session on it's own secure cookie
    {
        'cookie_name': 'data',
        'session_type': 'secure_cookie',
        'session_fields': 'auto'
    },
    # ... as many sessions as you want 
]

Caution: session_fields can collide if they have the same name and the same meaning. If they don't have the same meaning, you must use different field names.

The above configuration will define three session interfaces:

  • The first one is a secure cookie with 'csrf' name that will store the 'csrf_token' field.
  • The second one is a FirestoreSessionInterface that will set a cookie named 'session' with a single session id. The 'user_id' and 'user_data' will be stored in the Google Cloud Firestore backend.
  • The third one will store any other varibles stored in the session on another secure cookie.

After configuring just register it as an extension:

from flask_session_plus import Session

app = Flask(__name__)

Session(app)

or

from flask_session_plus import Session

app = Flask(__name__)

session = Session()

session.init_app(app)

Current available backends:

  • Secure Cookies Sessions (session_type key: 'secure_cookie')
  • Google Firestore Sessions (session_type key: 'firestore')
  • Redis Sessions (session_type key: 'redis')
  • MongoDB Sessions (session_type key: 'mongodb')
  • Memcache Sessions (session_type key: 'memcache')

More Backend Session Interfaces can be created by subclassing BackendSessionInterface and overwriting the following methods:

  1. __init__
  2. open_session
  3. save_session

All posible values for Session configuration:

  • Common properties for all backends:

    Property name Required Default Description
    cookie_name True The name of the cookie to use. It also serves as a key for different sessions.
    session_type False 'secure_cookie' The session backend to use.
    session_fields False [] The fields that are owned by this session. An empty list means: 'include all fields'. It can be: 1) an array of fields to include, 2) a dict with the keys 'include' or 'exclude', to include or exclude a list of fields or 3) the string 'auto' to auto exclude all the other session fields.

  • Properties for SecureCookie (available for all backends):

    Property name Required Default Description
    cookie_domain False The domain for the session cookie. If this is not set, the cookie will be valid for all subdomains of SERVER_NAME..
    cookie_path False The path for the session cookie. If this is not set the cookie will be valid for all of APPLICATION_ROOT or if that is not set for '/'.
    cookie_httponly False True Whether to allow access the cookie only over http or other ways (javascript).
    cookie_secure False False Whether to serve this cookie over https only.
    cookie_max_age False None The cookie expiration time in seconds. None means the cookie will expire at browser close.
    cookie_samesite False 'Lax' The cookie samesite configuration.

  • Properties available for any other backend rather than SecureCookie:

    Property name Required Default Description
    session_lifetime False timedelta(days=1) The duration for a valid session. Not used on SecureCookie backend.
    session_permanent_lifetime False timedelta(days=31) The duration for a valid session when it's marked as permanent. Not used on SecureCookie backend.
    key_prefix False 'session' The prefix to use in the store_id.
    use_signer False False Whether to sign the session id cookie or not.

  • Properties available for the Google Firestore backend:

    Property name Required Default Description
    client True The engine. An instance of firestore.Client.
    collection True The firestore collection you want to use to store sessions.

  • Properties available for the Redis backend:

    Property name Required Default Description
    client True The engine. An instance of redis.Redis.

  • Properties available for the MongoDB backend:

    Property name Required Default Description
    client True The engine. An instance of redis.Redis.
    db True The database you want to use.
    collection True The mongodb collection you want to use to store sessions.

  • Properties available for the Memcache backend:

    Property name Required Default Description
    client True The engine. An instance of memcache.Client.