Using sessions in Django

Question

I'm using sessions in Django to store login user information as well as some other information. I've been reading through the Django session website and still have a few questions.

From the Django website:

By default, Django stores sessions in your database (using the model django.contrib.sessions.models.Session). Though this is convenient, in some setups it’s faster to store session data elsewhere, so Django can be configured to store session data on your filesystem or in your cache.

Also:

For persistent, cached data, set SESSION_ENGINE to "django.contrib.sessions.backends.cached_db". This uses a write-through cache – every write to the cache will also be written to the database. Session reads only use the database if the data is not already in the cache.

Is there a good rule of thumb for which one to use? Cached_db seems like it would always be a better choice because best case, the data is in the cache, and worst case it's in the database where it would be anyway. The one downside is I have to setup memcached.

By default, SESSION_EXPIRE_AT_BROWSER_CLOSE is set

to False, which means session cookies will be stored in users' browsers for as long as SESSION_COOKIE_AGE. Use this if you don't want people to have to log in every time they open a browser.

Is it possible to have both, the session expire at the browser close AND give an age?

If value is an integer, the session will expire after that many seconds of inactivity. For example, calling request.session.set_expiry(300) would make the session expire in 5 minutes.

What is considered "inactivity"?

If you're using the database backend, note that session data can

accumulate in the django_session database table and Django does not provide automatic purging. Therefore, it's your job to purge expired sessions on a regular basis.

So that means, even if the session is expired there are still records in my database. Where exactly would one put code to "purge the db"? I feel like you would need a seperate thread to just go through the db every once in awhile (Every hour?) and delete any expired sessions.

Answer 1

Is there a good rule of thumb for which one to use?

No.

Cached_db seems like it would always be a better choice ...

That's fine.

In some cases, there a many Django (and Apache) processes querying a common database. mod_wsgi allows a lot of scalability this way. The cache doesn't help much because the sessions are distributed randomly among the Apache (and Django) processes.

Is it possible to have both, the session expire at the browser close AND give an age?

Don't see why not.

What is considered "inactivity"?

I assume you're kidding. "activity" is -- well -- activity. You know. Stuff happening in Django. A GET or POST request that Django can see. What else could it be?

Where exactly would one put code to "purge the db"?

Put it in crontab or something similar.

I feel like you would need a seperate thread to just go through the db every once in awhile (Every hour?)

Forget threads (please). It's a separate process. Once a day is fine. How many sessions do you think you'll have?