[mod_python] When using PSP is request object persistent?

Graham,
   
  I appreciate the reply. My method fits in the corner case you mention. The stripped down example is from a project where a protected area of the website is entered. The previous presence of the session means they're already logged in, and the absence means they are required to login. This logic is based upon the description of the is_new() method at http://www.modpython.org/live/current/doc-html/pyapi-sess-classes.html where it suggests you could use:
   
  sess = Session(req)
if sess.is_new():
    # redirect to login
    util.redirect(req, 'http://www.mysite.com/login')
   
  Of course, I'm doing something slightly different and composing a page from PSP templates. It's a shame this templating method which doesn't logically have anything to do with sessions (when viewed purely from a templating perspective) disables the ability to use is_new() in this way.
   
  I was going to store additional session information in a relational database anyway, so for me I guess the fix is to check for existence of corresponding record in the database as I'm definitely in control of that persistence! I'm going to have to store the last access time in the database too so I can implement the timing out of a session.
   
  Regards,
   
  Pete

Graham Dumpleton <graham.dumpleton at gmail.com> wrote:
  On 11/03/07, PETER BARKER wrote:
> Hello,
>
> See below for the stripped-down code to my problem/query. Note that I do not
> save the session anywhere.
>
> With the two PSP template lines commented, the session is always new
> (because I'm not saving it). When the templating code is uncommented, the
> session is remembered across requests. Why is this?
>
> APACHE CONFIG:
> 
> SetHandler mod_python
> PythonDebug On
> PythonHandler mod_python.publisher
> 
>
> INDEX.HTML:
> 
> 
> 
> 
> 
>
> THETEST.PY:
> from mod_python import Session, psp
> import os
> def entry(req):
> req.session = Session.Session(req)
> if req.session.is_new():
> returnedDoc = "Newly created session: " + req.session.id()
> else:
> returnedDoc = 'Existing session:' + req.session.id()
> #pathname = os.path.join(os.path.dirname(req.filename),'index.html')
> #psp.PSP(req,filename=pathname).run()
> req.content_type = 'text/html'
> return returnedDoc

Do you use the session object in the PSP page? If you do, then what
you are seeing is consistent with how PSP has perhaps always worked.

As the code stands, if a session object is created, whether it be
prior to PSP being invoked or as a result of a reference to the
session object in a PSP page, the PSP code is always saving the
session object to ensure that the last accessed time is updated.

If the session object wasn't actually referenced from within the PSP
page this raises an interesting corner case which wasn't perhaps
thought of when PSP was changed to use a session object present as
req.session. The issue is if req.session exists but the session object
is not used in the PSP page, should the PSP code be saving the session
to have the last accessed time updated.

Thus, the code in PSP code should perhaps instead of saying:

# the mere instantiation of a session changes it
# (access time), so it *always* has to be saved
if hasattr(req, 'session'):
req.session.save()

perhaps say:

# the mere instantiation of a session changes it
# (access time), so it *always* has to be saved
if "session" in code.co_names and hasattr(req, 'session'):
req.session.save()

In summary, it is a feature of PSP that if a session object is used in
a PSP page that the session is always saved automatically. The
question is whether it should be saving it when the session was
created before PSP was invoked and the session isn't used in the PSP
page. Problem is that changing the behaviour may be too late now that
it is working this way.


Graham

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mm_cfg_has_not_been_edited_to_set_host_domains/pipermail/mod_python/attachments/20070311/888f5fe3/attachment-0001.html