Cookieless Django for government site

Question

As I'm writing a django site from government bodies I'm not going to be able to use cookies. I found this snippet http://djangosnippets.org/snippets/1540/ but it's currently not allowing users to login. Before I start debugging I wondered if anyone else has solved this problem with this snippet or in any other way?

UPDATE

The ONLY answer seems to be the middleware/session in URL route but this becomes and even worse solution if you have a site which has a public section and a private section accessible when logged in. The route we have decided to go is to 'follow' the guidelines:

1. The content and purpose of any cookie that is delivered by your website should always be communicated to the user.
2. Users should have the ability to refuse a cookie without it affecting the basic usability of your website.
3. Your website should notify your users if technical features of your site will be degraded as a result of their declining to accept cookies from it.

Our definition of basic is all the stuff that you can see without logging in. Let's hope that will sway them. This guideline dates back to 2002 and does not cater for modern web apps. Fingers crossed...

Thanks for everyones contributions.

Answer 1

While you can use django without cookies, in millions of ways, all of which would assume you don't need to track session data. Keeping session data by means of cookies is probably the most reliable and secure way, both for the users and for you. The alternatives are appending session IDs to the end of urls (which potentially exposes those session ids to outside servers via the referrer header) and tracking ip which just won't work, except in the event that only one user would come from one IP at a time and you know the IPs of all the users and they would rarely change, I can't imagine something like that implemented in a web application in 2010.

Answer 2

You could key the data to the REMOTE_USER request header passed to the application (if it exists), but this would require both custom middleware and auth configuration in the web server to work fully.

Answer 3

You can use HTTP Authentication (either Basic, or Digest). Most web browsers allow for storing these credentials, or having them expire when a browsing session is finished. The admin doesn't care how the authentication is done, so you can have sessions not even enabled.

Note that with HTTP Basic auth, you'll need to be serving under https, as the header is essentially cleartext containing the username and password.