quetz-mod_python-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Graham Dumpleton (JIRA)" <j...@apache.org>
Subject [jira] Commented: (MODPYTHON-59) Add get_session() method to request object
Date Sat, 23 Jul 2005 12:29:45 GMT
    [ http://issues.apache.org/jira/browse/MODPYTHON-59?page=comments#action_12316578 ] 

Graham Dumpleton commented on MODPYTHON-59:

There is a potential issue with the way that PYSID is stored in the
subprocess_env table and then used to reconstruct the session object
after an internal redirect.

I can see two problems here. The first is that if the target of the
internal redirect is a part of the URL namespace which is under the
control of a different handler, or where ApplicationPath option was set
explicitly to be different, the PYSID would potentially override a valid
pysid for the alternate SID context provided by the browser.

The second problem is that an internal redirect could redirect to a
different part of the URL namespace where the PythonOption for "session"
is set differently. This could for example result in an instance of
Session being created initially but an attempt to create a FileSession
object after the redirect.

In the second case, if the redirect was to a part of the URL namespace
notionally under the same ApplicationPath (implicit or explicit), it is
probably a mistake on the part of the programmer to have specified
different session types within the same SID context. It still could occur
in conjunction with the first case though.

Is my analysis here correct? Along with PYSID it may be necessary to
save away the equivalent of the ApplicationPath (implicit or explicit)
and for the PYSID to be ignored if the target of the internal redirect is
within a different SID context. It would get harder to protect if there were
multiple nested applications of internal redirect. Ie., where you end up

> Add get_session() method to request object
> ------------------------------------------
>          Key: MODPYTHON-59
>          URL: http://issues.apache.org/jira/browse/MODPYTHON-59
>      Project: mod_python
>         Type: New Feature
>   Components: core
>     Versions: 3.2.0
>  Environment: All
>     Reporter: Jim Gallacher

> Users will get session instances by calling req.get_session(). If a session already exists
it will be returned, otherwise a new session instance will be created. Session configuration
will be handled using apache directives rather than within their code.
> Using this scheme means only one session instance will be created per request, which
will eliminate the deadlock problems many people experience. Also, using this scheme makes
it possible for sessions to be properly handled within psp pages and across req.internal_redirect()
> Code will be commited to svn shortly.

This message is automatically generated by JIRA.
If you think it was sent incorrectly contact one of the administrators:
For more information on JIRA, see:

View raw message