# Patching django sessions to control user sessions

DevFeed: [Patching django sessions to control user sessions](<https://devfeed.tech/articles/patching-django-sessions-to-control-user-sessions-19995.md>)

Original publisher: [Read original article](<http://engineering.hackerearth.com/2015/02/14/django-sessions-patch/>)

Published: 2015-02-14T00:00:00Z

Content type: article

Language: en

Sources: [HackerEarth](<https://devfeed.tech/sources/hackerearth.md>)

Topics: [Django](<https://devfeed.tech/topics/django.md>), [Redis](<https://devfeed.tech/topics/redis.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [passwords](<https://devfeed.tech/topics/passwords.md>), [Framework](<https://devfeed.tech/topics/framework.md>), [MySQL](<https://devfeed.tech/topics/mysql.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [backend](<https://devfeed.tech/tags/backend.md>), [django](<https://devfeed.tech/tags/django.md>), [mysql](<https://devfeed.tech/tags/mysql.md>), [password](<https://devfeed.tech/tags/password.md>), [redis](<https://devfeed.tech/tags/redis.md>)

## AI overview

This article explains how HackerEarth patched Django session handling to find and control all sessions belonging to a user. It uses Redis session keys containing a constant user-specific string, avoiding a full scan and decoding of stored session data when sessions must be removed, such as after a password change.

## Source excerpt

###Introduction HackerEarth uses django framework at its heart. We use two third party django packages for the purpose of user authentication and session management: django-allauth: Provides pre-built modules for email-based as well as all popular social authentication mechanisms. django-redis-sessions: Allows storage of user session data in redis(a memory based data store that writes on disk) for fast retrieval. We used MySQL earlier for this purpose but the retrieval became very slow as number of users grew. Django sessions are simple dictionaries which look something like this: { '_session_cache': { '_auth_user_id': 2L, '_auth_user_backend': 'allauth.account.auth_backends.AuthenticationBackend', }, '_session_key': '44617f83e234b6aa7e632abb8b44b906', 'modified': False, 'accessed': True } The _session_cache contains the information about the user who is logged in, the backend that is used for user authentication(since we do not use django's default authentication backend, the value is different here). Also if you set any other data on the session it will be present inside the _session_cache dictionary. The _session_key is generated by the session backend using a random function. All the sessions are stored in redis in the form of key value pairs where the key is the _session_key and value is _session_cache in encoded format. ###The problem As it can be clearly seen, there is no way to determine which key belongs to which user apart from getting that key's data from the data-store and checking the user id associated with that data. Now consider a scenario where you want to find all the sessions associated with a given user. One of the use cases can be when a user changes their password, we would want to delete all their existing sessions. In such a scenario, you will have to iterate over all the rows of data, decode it and check if it belongs to a certain user. This might work well when there are a few hundred users on your site, but with a large number of users, th