zc.wsgisessions 0.6.1

Sessions

There are two aspects to the sessions support: browser identification, and session storage. Browsers are identified using cookies; if the cookie isn’t set on an incoming request, the response sets it for future requests.

Session data are stored using a persistent session data container, as defined by the zope.session package. An instance is added to the database at startup if not present. We can control certain parameters by passing keyword arguments to the database initializer. One run of this test uses the default settings, while a second run sets custom parameters.

>>> import re
>>> import zc.wsgisessions.testing
>>> import zc.wsgisessions.sessions
>>> db_name = 'sessions'
>>> if zc.wsgisessions.testing.TEST_DB_INIT:
...     db_name = 'test'
...     db = conn.get_connection(db_name).db()
...     zc.wsgisessions.sessions.initialize_database(
...         db,
...         db_name=db_name,
...         namespace='browserid_c0defeed',
...         secret='0.10612221415937506119',
...         timeout=(15 * 60),  # 15 minutes
...         resolution=60,      #  1 minute
...         )

>>> dbroot = conn.get_connection(db_name).root()
>>> dbroot['sessions']
<zope.session.session.PersistentSessionDataContainer object at 0xc0defeed>

>>> if zc.wsgisessions.testing.TEST_DB_INIT:
...     expected_id = re.compile('browserid_c0defeed')
...     expected_secret = re.compile('0.10612221415937506119')
...     expected_timeout = 15 * 60
...     expected_resolution = 60
... else:
...     expected_id = re.compile('browserid_[0-9a-f]{8}')
...     expected_secret = re.compile('[0-9a-f]{20}')
...     expected_timeout = 24 * 60 * 60
...     expected_resolution = 60 * 60
>>> re.match(expected_id, dbroot['browserid_info'][0]) is not None
True
>>> re.match(expected_secret, dbroot['browserid_info'][1]) is not None
True
>>> dbroot['sessions'].timeout == expected_timeout
True
>>> dbroot['sessions'].resolution == expected_resolution
True

If the configuration contains secure set to true or if the request is https, secure is added to the Set-Cookie response. Also HttpOnly is added to the Set-Cookie response, unless the configuration sets http-only to false.

>>> global_conf = {}
>>> filter_conf = {'db-name': db_name}
>>> filter = zc.wsgisessions.sessions.BrowserIdFilter(
...     global_conf, **filter_conf)(object())
>>> environ = {
...     'zodb.connection': conn.get_connection('test'),
...     'wsgi.url_scheme': 'https'
... }
>>> h = dict(filter.prepare(environ, lambda *args: args)(200, [], None)[1])
>>> cookie_parts = h['Set-Cookie'].split('; ')
>>> 'secure' in cookie_parts
True
>>> 'HttpOnly' in cookie_parts
True

When the settings are changed in the filter configuration (in .ini file), the defaults are replaced.

>>> filter_conf.update({'http-only': 'false', 'secure': 'true',
...                     'domain': '.example.com', 'max-age': '5000',
...                     'path': '/foo'})
>>> filter = zc.wsgisessions.sessions.BrowserIdFilter(
...     global_conf, **filter_conf)(object())
>>> environ['wsgi.url_scheme'] = 'http'
>>> h = dict(filter.prepare(environ, lambda *args: args)(200, [], None)[1])
>>> cookie_parts = h['Set-Cookie'].split('; ')
>>> 'secure' in cookie_parts
True
>>> 'HttpOnly' in cookie_parts
False
>>> 'Domain=.example.com' in cookie_parts
True
>>> 'Max-Age=5000' in cookie_parts
True
>>> 'Path=/foo' in cookie_parts
True

Notice that the URL scheme above was not https, but the secure was set because it was requested in the filter configuration.

For Selenium testing we need to reset HttpOnly and since we are using http URL scheme in development, the default for secure (off) is acceptable. Notice that we are setting http-only in global configuration this time to override the value from the settings in .ini file.

>>> global_conf = {'http-only': 'off'}
>>> filter_conf = {'db-name': db_name, 'http-only': 'on'}
>>> filter = zc.wsgisessions.sessions.BrowserIdFilter(
...     global_conf, **filter_conf)(object())
>>> h = dict(filter.prepare(environ, lambda *args: args)(200, [], None)[1])
>>> cookie_parts = h['Set-Cookie'].split('; ')
>>> 'secure' in cookie_parts
False
>>> 'HttpOnly' in cookie_parts
False

The database name for session storage is set in initialize_database to sessions by default or to a supplied db_name (test for the second run of these tests). If we try to pass a wrong database name to the filter from its configuration (in .ini file) we’ll get an error.

>>> if zc.wsgisessions.testing.TEST_DB_INIT:
...     filter_conf['db-name'] = 'sessions'
...     filter = zc.wsgisessions.sessions.BrowserIdFilter(
...         global_conf, **filter_conf)(object())
... else:
...     filter_conf['db-name'] = 'test'
...     filter = zc.wsgisessions.sessions.BrowserIdFilter(
...         global_conf, **filter_conf)(object())
>>> h = dict(filter.prepare(environ, lambda *args: args)(200, [], None)[1])
Traceback (most recent call last):
  ...
KeyError: 'browserid_info'

CHANGES