Ebbe BaßandClaude Sonnet 5.5
73505ac717
Audit entries written only inside the caller's transaction, database throttle counters that refuse to run inside a transaction that could roll back, and a database session store with the user key in its own column, end_sessions and idle and absolute limits. Ticket 1.3. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Sk72AxLwQnYttF6VFSxQLt
21 lines
670 B
Python
21 lines
670 B
Python
"""Absolute session limit; the idle limit is SESSION_COOKIE_AGE with save-every-request."""
|
|
|
|
import time
|
|
|
|
from django.conf import settings
|
|
|
|
from .session_store import CREATED_AT
|
|
|
|
|
|
class AbsoluteSessionLimitMiddleware:
|
|
def __init__(self, get_response):
|
|
self.get_response = get_response
|
|
|
|
def __call__(self, request):
|
|
session = request.session
|
|
created = session.get(CREATED_AT)
|
|
if created is not None and time.time() - created > settings.SESSION_ABSOLUTE_SECONDS:
|
|
# flush() deletes the row; the empty session makes SessionMiddleware clear the cookie.
|
|
session.flush()
|
|
return self.get_response(request)
|