[mod_python] mod_python sessions, locking, and PSP

Michael Spang wrote:
> I recently ran into deadlocks using sessions in both my mod_python
> handler and in psp. I've read through the thread at
> http://www.modpython.org/pipermail/mod_python/2005-May/018035.html and
> understand that this occurs because both my handler and PSP create their
> own session instance and attempt to lock the session.
> 
> My question is: why doesn't the mod_python sessions module keep a
> reference to each constructed session object and the thread that has it
> locked? 

Easier said than done in mpm-prefork or mpm-worker. It's possible to
keep track of the session object within a single request, but difficult
(as in nearly impossible) to do it across requests in these 2 mpms.

> It should be possible for PSP to find and use the session object
> created by the handler.
> 
> To work around this, you need to either:
>     1. manually unlock the session, or
>     2. pass the session to the PSP template in a different way (e.g., as
> an attribute of the request object), or

This is the preferred (although not ideal) method. In version 3.3 if psp
creates a new session it saves a reference in req.session. It's also a
little smarter about unlocking. It'll only unlock a session that has
been created within psp.

>     3. move everything that uses the session from the handler into the
> template.
> 
> None of these are particularly appealing. Support for the session
> facility is a great feature in PSP, but it is hindered by its inability
> to coexist with use of sessions outside of the template. It is quite
> confusing when merely referencing the 'session' variable in a template
> causes a deadlock. I was unaware of PSP's session support when I
> encountered this problem; I had passed my handler's session object in
> via the 'vars' argument of PSP.run().

You'll get no argument from me there. It's less than ideal, but it's not
entirely true that a session in psp can't co-exist with session use
outside of psp. You just need to know the magic incantation. (And yes,
the documentation on this is insufficient).

So there are 2 approaches:

1. In your handler use req.session = Session.Session(req).
   Don't pass the session object in vars arg of PSP.run().
   Use the 'session' variable name in your psp template and depend on
it's magic.

2. In your handler use sess = Session.Session(req)
   Pass 'sess' in with your psp vars.
   *Don't* use the 'session' variable name in your psp template, and
avoid the magic. Use something else like 'sess' or 'my_sess'.

At one point I was working on a req.get_session() method to fix some of
these issues, but the attempt was abandoned for a number of reasons -
one being that it would introduce even more magic. There is still a code
stub in svn trunk, but it'll likely be expunged before a 3.3 release.
Any such feature will have to wait until 3.4.

I've been thinking about some ideas for a session locking tutorial, as
it is one of the more confusing aspects of mod_python - until you
understand the magic. ;)

Jim