Understanding Sessions and Cookies in Django 5

HTTP is a stateless protocol, meaning that each request to a server is independent and the server does not retain information about previous interactions. To maintain state between requests, web applications use session management techniques such as cookies and server-side sessions.

Cookies

Cookies are small pieces of data stored on the client's browser. They are used to identify users and track sessions. When a user visits a website, the server can send a Set-Cookie header in the HTTP response. The browser stores this cookie and sends it back in subsequent requests via the Cookie header.

In Django, you can manage cookies using the request.COOKIES dictionary or the set_cookie and delete_cookie methods on the HttpResponse object.

• Accessing Cookies:

request.COOKIES.get('key', 'default_value')

8. Setting Cookies:

response.set_cookie('key', 'value', max_age=3600)

10. Deleting Cookies:

response.delete_cookie('key')

Sessions

Session are a way to store user-specific data on the server. Each session is identified by a unique session ID, which is typical stored in a cookie on the client side. Django provides a built-in session framework that abstracts away the complexity of managing session data securely.

Session data can be stored in various backends including databases, cache, files, or even signed cookies.

• Accessing Session Data:

request.session.get('key', None)

17. Setting Sesssion Data:

request.session['key'] = 'value'

19. Deleting Session Data:

del request.session['key']

21. Clearing Session:

request.session.flush()

Cookie vs Session

Example: Implementing Login with Session and Cookie

Below is a basic example of handling user login with session and cookie in Django:

• views.py

def to_login(request):
    return render(request, 'login.html')

def login(request):
    username = request.POST.get('user_name')
    password = request.POST.get('pwd')
    if username == 'python222' and password == '123456':
        request.session['username'] = username
        response = render(request, 'main.html')
        response.set_cookie('remember_me', 'true')
        return response
    else:
        return render(request, 'login.html', {'error': 'Invalid credentials'})
  

• urls.py

from django.urls import path
from . import views

urlpatterns = [
    path('login/', views.to_login),
    path('authenticate/', views.login),
]
  

• login.html

<form method="post" action="/authenticate/">
  {% csrf_token %}
  <input type="text" name="user_name" />
  <input type="password" name="pwd" />
  <input type="submit" value="Login" />
  {% if error %}
  <div style="color:red">{{ error }}</div>
  {% endif %}
</form>
  

• main.html

<h1>Welcome, {{ request.session.username }}</h1>

Django Session Configuration

Django allows you to configure how session data is stored. You can set the session engine in your settings.py file:

# Session engine options
SESSION_ENGINE = 'django.contrib.sessions.backends.db'  # Default
# SESSION_ENGINE = 'django.contrib.sessions.backends.cache'
# SESSION_ENGINE = 'django.contrib.sessions.backends.file'
# SESSION_ENGINE = 'django.contrib.sessions.backends.cached_db'
# SESSION_ENGINE = 'django.contrib.sessions.backends.signed_cookies'

# Cookie settings
SESSION_COOKIE_NAME = 'sessionid'
SESSION_COOKIE_AGE = 1209600  # 2 weeks
SESSION_EXPIRE_AT_BROWSER_CLOSE = False