how to find user id from session_data from django_session table?

前端 未结 6 1657
粉色の甜心
粉色の甜心 2020-12-28 15:24

In django_session table session_data is stored which is first pickled using pickle module of python and then encoded in base64 by using base64 modu

6条回答
  •  感情败类
    2020-12-28 16:04

    NOTE: format changed since original answer, for 1.4 and above see the update below

    import pickle
    
    data = pickle.loads(base64.decode(session_data))
    
    >>> print data
    {'_auth_user_id': 2L, '_auth_user_backend': 'django.contrib.auth.backends.ModelBackend',
     '_session_expiry': 0}
    

    [update]

    My base64.decode requires filename arguments, so then I tried base64.b64decode, but this returned "IndexError: list assignment index out of range".

    I really don't know why I used the base64 module, I guess because the question featured it.

    You can just use the str.decode method:

    >>> pickle.loads(session_data.decode('base64'))
    {'_auth_user_id': 2L, '_auth_user_backend': 'django.contrib.auth.backends.ModelBackend',
     '_session_expiry': 0}
    

    I found a work-around (see answer below), but I am curious why this doesn't work.

    Loading pickled data from user sources (cookies) is a security risk, so the session_data format was changed since this question was answered (I should go after the specific issue in Django's bug tracker and link it here, but my pomodoro break is gone).

    The format now (since Django 1.4) is "hash:json-object" where the first 40 byte hash is a crypto-signature and the rest is a JSON payload. For now you can ignore the hash (it allows checking if the data was not tampered by some cookie hacker).

    >>> json.loads(session_data.decode('base64')[41:])
    {u'_auth_user_backend': u'django.contrib.auth.backends.ModelBackend',
     u'_auth_user_id': 1}
    

提交回复
热议问题