Django Login/Session Not Sticking

问题

After my site has been up and running for a while in production, I suddenly have a problem with my users loging into it.

I have protected certain views/pages with the login_required decorator and I am also using the django admin. When an anonymous user hits any of these pages, he is redirected to the login page. When this anonymous user adds its credentials, the POST request is successful and he is redirected to the inital page. At the same time, the user gets a new sessionid (as expected) However, now the results get very unreliable. When pressing reload or when navigating to other pages (that require a login), either of the 2 outcomes might happen: a) The user is identified and the page is displayed correctly b) The user is redirect to the login page. I have checked the content of the session via the shell, and nothing is changing there.

The production site is served via a load balancer and 8 application servers. Even stranger: if I test the same code (with the same settings) on a test server, that is not load balanced and basically has not traffic, everything is working fine.

I am running Django 1.6 on Ubuntu with Apache and mod_wsgi in daemon mode behind SSL and I am using the Session database backend. I am using django-allauth.account for account management/login. My Session settings are like this:

SESSION_COOKIE_HTTPONLY = True
SESSION_COOKIE_AGE = 60*60*24
SESSION_COOKIE_SECURE = True

UPDATE

To get some more debug information, I have created this Middleware:

from django.conf import settings

class SessionDebugMiddleware(object):
    def process_response(self, request, response):
        session = request.session
        user = getattr(request, 'user', None)
        if user:
            user=user.id
        session_key = request.COOKIES.get(settings.SESSION_COOKIE_NAME, None)
        response['X-Meta-Requ'] = '{0},{1},{2},{3}'.format(session_key, session.get('_auth_user_id'), session.get('_auth_user_backend','---'), user)
        return response

If I hit the refresh button 10 times,

8 times I will get this header: igv0xshezhdxh50kks9x00r0l67mx0sk,None,---,None
2 times I will get this header: X-Meta-Requ:igv0xshezhdxh50kks9x00r0l67mx0sk,330619,django.contrib.auth.backends.ModelBackend,330619

It seems be be random and does not follow any logic.

So I have the following questions/ideas?

Can this be related to loadbalancing in anyway? My understanding was that Django does not need sticky sessions, when the DB session backend is used.
Can this be related to a threading issue?
Can this be related to high load?
Can this be related to a decoding issue: https://github.com/django/django/blob/master/django/contrib/sessions/backends/base.py#L83. But why should that decoding issue not be consistent. And I have not found any log entries that refer to "Session data corrupted".

Any other hints are welcome.

回答1:

Just in case someone is having this issue, it can also be caused by SECRET_KEY definitions not being consistent.

I had mine generated in the settings file (a bad decision). It was fine in development mode, but once the application was served by WSGI, multiple instances were created, each with different keys. This causes the mixup in the hash, and the corrupt session to be reported.

回答2:

I think you have problem because of highload or error in your code (maybe you just rebuild session in your application anywhere and forget about it :)

Please try to read info from database with your session key to be sure session data exists.

If data exists but not loaded to session - this mean you have troubles with session processing. If data doesn't exists, but it present in past because you got 2 times right session data, this mean you have problems with session storage (maybe because of highload your database lose sessions data). Do you have database replication?

Also which session backend you use? Just a DB or Cached_Db?

来源：https://stackoverflow.com/questions/24036831/django-login-session-not-sticking

标签

django

session

authentication

django-allauth