Bài 15: Sessions and Cookies

Sessions Là Gì?

Sessions cho phép lưu trữ data cho mỗi user giữa các requests. Django lưu session data trên server và gửi session ID qua cookie.

# How sessions work:# 1. User visits site# 2. Django creates unique session ID# 3. Session ID stored in cookie on user's browser# 4. Session data stored on server (database, cache, file, etc.)# 5. Each request includes session ID cookie# 6. Django retrieves session data using session ID # settings.py - Sessions enabled by defaultINSTALLED_APPS = [    'django.contrib.sessions',  # Session framework    # ...] MIDDLEWARE = [    'django.contrib.sessions.middleware.SessionMiddleware',    # Must be before authentication middleware    # ...] # Session engine (default: database)SESSION_ENGINE = 'django.contrib.sessions.backends.db' # Session available in views as request.sessiondef my_view(request):    # Set session data    request.session['user_id'] = 123    request.session['cart'] = ['item1', 'item2']        # Get session data    user_id = request.session.get('user_id')    cart = request.session.get('cart', [])

Sessions vs Cookies

# Cookies: Stored on client (browser)# - Limited size (~4KB)# - Visible to user# - Can be modified by user# - Good for: preferences, tracking # Sessions: Stored on server# - No size limit (within reason)# - Hidden from user# - Cannot be modified by user# - Good for: sensitive data, shopping cart, user state # Example: Shopping cart# Bad (cookie) - data exposed and modifiable:response.set_cookie('cart', 'item1,item2,item3') # Good (session) - only ID in cookie, data on server:request.session['cart'] = ['item1', 'item2', 'item3']

Working with Sessions

Setting Session Data

# Basic set/getdef add_to_cart(request, product_id):    # Initialize session data    if 'cart' not in request.session:        request.session['cart'] = []        # Add item    request.session['cart'].append(product_id)        # Mark session as modified (for mutable objects)    request.session.modified = True        return redirect('cart') # Set multiple valuesdef login_view(request):    if user_authenticated:        request.session['user_id'] = user.id        request.session['username'] = user.username        request.session['login_time'] = str(timezone.now())        request.session['is_staff'] = user.is_staff # Store complex datadef save_form_data(request):    request.session['form_data'] = {        'step': 2,        'personal_info': {            'name': 'John Doe',            'email': 'john@example.com'        },        'preferences': ['newsletter', 'notifications']    }

Reading Session Data

# Get session datadef view_cart(request):    # Get with default value    cart = request.session.get('cart', [])        # Get without default (raises KeyError if not exists)    try:        user_id = request.session['user_id']    except KeyError:        return redirect('login')        # Check if key exists    if 'cart' in request.session:        cart_items = request.session['cart']        return render(request, 'cart.html', {'cart': cart}) # Access all session datadef debug_view(request):    # Get all session keys    keys = request.session.keys()        # Get all session items    items = request.session.items()        # Session as dict    session_dict = dict(request.session)        return render(request, 'debug.html', {'session': session_dict})

Modifying Session Data

# Update session datadef update_cart(request, product_id, quantity):    cart = request.session.get('cart', {})    cart[str(product_id)] = quantity    request.session['cart'] = cart        return redirect('cart') # Modify nested datadef update_preferences(request):    # IMPORTANT: For mutable objects (dict, list), must set modified=True    request.session['preferences']['theme'] = 'dark'    request.session.modified = True  # Tell Django session changed        # Alternative: Reassign entire object    preferences = request.session.get('preferences', {})    preferences['theme'] = 'dark'    request.session['preferences'] = preferences  # Auto-detects change # Increment counterdef page_view(request):    # Get current count    views = request.session.get('page_views', 0)    # Increment    request.session['page_views'] = views + 1

Deleting Session Data

# Delete specific keydef remove_from_cart(request, product_id):    cart = request.session.get('cart', [])    if product_id in cart:        cart.remove(product_id)        request.session['cart'] = cart        return redirect('cart') # Delete key with popdef clear_user_data(request):    user_id = request.session.pop('user_id', None)    username = request.session.pop('username', None) # Delete key with deldef logout_view(request):    try:        del request.session['user_id']        del request.session['username']    except KeyError:        pass # Clear all session datadef clear_session(request):    request.session.clear()  # Removes all data    return redirect('home') # Flush session (clear and delete session ID)def logout_completely(request):    request.session.flush()  # Clears data and creates new session    return redirect('login')

Session Configuration

Session Settings

# settings.py # Session engine options:SESSION_ENGINE = 'django.contrib.sessions.backends.db'  # Database (default)# SESSION_ENGINE = 'django.contrib.sessions.backends.cache'  # Cache only# SESSION_ENGINE = 'django.contrib.sessions.backends.cached_db'  # Cache + DB# SESSION_ENGINE = 'django.contrib.sessions.backends.file'  # File-based# SESSION_ENGINE = 'django.contrib.sessions.backends.signed_cookies'  # Cookie # Session cookie settingsSESSION_COOKIE_NAME = 'sessionid'  # Cookie nameSESSION_COOKIE_AGE = 1209600  # 2 weeks (in seconds)SESSION_COOKIE_DOMAIN = None  # None = current domainSESSION_COOKIE_SECURE = True  # HTTPS only (production)SESSION_COOKIE_HTTPONLY = True  # Not accessible via JavaScriptSESSION_COOKIE_SAMESITE = 'Lax'  # CSRF protection # Session behaviorSESSION_SAVE_EVERY_REQUEST = False  # Save session on every requestSESSION_EXPIRE_AT_BROWSER_CLOSE = False  # Expire when browser closes # Cookie age for "remember me"if remember_me:    request.session.set_expiry(1209600)  # 2 weekselse:    request.session.set_expiry(0)  # Browser close

Session Expiry

# Set custom expirydef login_view(request):    # Expire in 1 hour    request.session.set_expiry(3600)        # Expire at specific datetime    from datetime import datetime, timedelta    expiry_date = datetime.now() + timedelta(days=7)    request.session.set_expiry(expiry_date)        # Expire when browser closes    request.session.set_expiry(0)        # Use default expiry from settings    request.session.set_expiry(None) # Get expiry infodef session_info(request):    # Get expiry age in seconds    age = request.session.get_expiry_age()        # Get expiry date    expiry_date = request.session.get_expiry_date()        # Check if expires at browser close    browser_close = request.session.get_expire_at_browser_close()        return render(request, 'session_info.html', {        'age': age,        'expiry_date': expiry_date,        'browser_close': browser_close    })

Session Backends

# Database backend (default)SESSION_ENGINE = 'django.contrib.sessions.backends.db'# Pros: Persistent, reliable# Cons: Slower, database overhead# Use: Production with moderate traffic # Cache backendSESSION_ENGINE = 'django.contrib.sessions.backends.cache'CACHES = {    'default': {        'BACKEND': 'django.core.cache.backends.redis.RedisCache',        'LOCATION': 'redis://127.0.0.1:6379',    }}# Pros: Very fast# Cons: Data lost if cache cleared# Use: High-traffic sites, temporary data # Cached database backendSESSION_ENGINE = 'django.contrib.sessions.backends.cached_db'# Pros: Fast (cache) + persistent (DB)# Cons: More complex# Use: Best of both worlds # File backendSESSION_ENGINE = 'django.contrib.sessions.backends.file'SESSION_FILE_PATH = '/var/tmp/django_sessions'# Pros: Simple, no database needed# Cons: Slower than cache, file permission issues# Use: Development, small sites # Signed cookie backendSESSION_ENGINE = 'django.contrib.sessions.backends.signed_cookies'# Pros: No server storage# Cons: 4KB limit, data visible to user# Use: Minimal session data

Working with Cookies

Setting Cookies

def set_cookie_view(request):    response = render(request, 'page.html')        # Basic cookie    response.set_cookie('username', 'john')        # Cookie with expiry (seconds)    response.set_cookie('token', 'abc123', max_age=3600)  # 1 hour        # Cookie with expiry date    from datetime import datetime, timedelta    expires = datetime.now() + timedelta(days=7)    response.set_cookie('preference', 'dark_mode', expires=expires)        # Secure cookie (HTTPS only)    response.set_cookie(        'secure_data',        'sensitive',        secure=True,        httponly=True,        samesite='Strict'    )        # Cookie for specific domain/path    response.set_cookie(        'site_id',        '123',        domain='.example.com',  # All subdomains        path='/blog/'           # Only /blog/ path    )        return response

Reading Cookies

def read_cookie_view(request):    # Get cookie with default    username = request.COOKIES.get('username', 'Guest')        # Check if cookie exists    if 'preference' in request.COOKIES:        preference = request.COOKIES['preference']        # Get all cookies    all_cookies = request.COOKIES        return render(request, 'page.html', {        'username': username,        'cookies': all_cookies    }) # Use cookie in template# {{ request.COOKIES.username }}

Deleting Cookies

def delete_cookie_view(request):    response = redirect('home')        # Delete cookie    response.delete_cookie('username')        # Delete cookie with specific domain/path    response.delete_cookie(        'preference',        domain='.example.com',        path='/blog/'    )        return response

Signed Cookies

# Signed cookies (tamper-proof)def set_signed_cookie(request):    response = render(request, 'page.html')        # Set signed cookie    response.set_signed_cookie('user_id', '123', salt='user-salt')        return response def read_signed_cookie(request):    # Get signed cookie    try:        user_id = request.get_signed_cookie(            'user_id',            salt='user-salt',            max_age=3600  # Reject if older than 1 hour        )    except (KeyError, BadSignature):        user_id = None        return render(request, 'page.html', {'user_id': user_id})

Practical Examples

Shopping Cart with Sessions

# views.pydef add_to_cart(request, product_id):    # Initialize cart    cart = request.session.get('cart', {})        # Get product    product = get_object_or_404(Product, pk=product_id)        # Add or increment quantity    product_id_str = str(product_id)    if product_id_str in cart:        cart[product_id_str]['quantity'] += 1    else:        cart[product_id_str] = {            'name': product.name,            'price': str(product.price),            'quantity': 1        }        # Save cart    request.session['cart'] = cart        messages.success(request, f'{product.name} added to cart')    return redirect('product_list') def view_cart(request):    cart = request.session.get('cart', {})        # Calculate total    total = sum(        float(item['price']) * item['quantity']        for item in cart.values()    )        return render(request, 'cart.html', {        'cart': cart,        'total': total    }) def update_cart(request, product_id):    cart = request.session.get('cart', {})    product_id_str = str(product_id)        if product_id_str in cart:        quantity = int(request.POST.get('quantity', 1))        if quantity > 0:            cart[product_id_str]['quantity'] = quantity        else:            del cart[product_id_str]                request.session['cart'] = cart        request.session.modified = True        return redirect('view_cart') def clear_cart(request):    if 'cart' in request.session:        del request.session['cart']    return redirect('product_list')

Multi-Step Form with Sessions

# Step 1: Personal infodef registration_step1(request):    if request.method == 'POST':        # Save to session        request.session['registration'] = {            'step': 1,            'first_name': request.POST.get('first_name'),            'last_name': request.POST.get('last_name'),            'email': request.POST.get('email'),        }        return redirect('registration_step2')        return render(request, 'registration/step1.html') # Step 2: Addressdef registration_step2(request):    # Check if step 1 completed    if 'registration' not in request.session:        return redirect('registration_step1')        if request.method == 'POST':        # Update session        registration = request.session['registration']        registration['step'] = 2        registration['address'] = request.POST.get('address')        registration['city'] = request.POST.get('city')        request.session['registration'] = registration                return redirect('registration_step3')        return render(request, 'registration/step2.html') # Step 3: Review and confirmdef registration_step3(request):    registration = request.session.get('registration')        if not registration or registration.get('step') < 2:        return redirect('registration_step1')        if request.method == 'POST':        # Create user        user = User.objects.create_user(            username=registration['email'],            email=registration['email'],            first_name=registration['first_name'],            last_name=registration['last_name']        )                # Create profile with address        Profile.objects.create(            user=user,            address=registration['address'],            city=registration['city']        )                # Clear session        del request.session['registration']                messages.success(request, 'Registration complete!')        return redirect('login')        return render(request, 'registration/step3.html', {        'registration': registration    })

Remember Me Functionality

def login_view(request):    if request.method == 'POST':        username = request.POST.get('username')        password = request.POST.get('password')        remember_me = request.POST.get('remember_me')                user = authenticate(username=username, password=password)                if user:            login(request, user)                        # Set session expiry based on remember_me            if remember_me:                # Remember for 30 days                request.session.set_expiry(2592000)            else:                # Expire on browser close                request.session.set_expiry(0)                        return redirect('dashboard')        return render(request, 'login.html')

User Preferences with Cookies

def set_theme(request):    theme = request.GET.get('theme', 'light')        response = redirect(request.META.get('HTTP_REFERER', '/'))        # Set theme cookie for 1 year    response.set_cookie(        'theme',        theme,        max_age=31536000,  # 1 year        httponly=True    )        return response # Context processor to make theme available everywhere# context_processors.pydef theme_processor(request):    theme = request.COOKIES.get('theme', 'light')    return {'theme': theme} # settings.pyTEMPLATES = [{    'OPTIONS': {        'context_processors': [            # ...            'myapp.context_processors.theme_processor',        ],    },}] # Use in template# <body class="theme-{{ theme }}">

Page View Counter

def track_page_views(request):    # Total site visits (session)    total_views = request.session.get('total_views', 0)    request.session['total_views'] = total_views + 1        # Page-specific views (session)    page_views = request.session.get('page_views', {})    page = request.path    page_views[page] = page_views.get(page, 0) + 1    request.session['page_views'] = page_views    request.session.modified = True        # Last visited pages    last_visited = request.session.get('last_visited', [])    last_visited.insert(0, {        'url': request.path,        'time': str(timezone.now())    })    # Keep only last 10    request.session['last_visited'] = last_visited[:10]        return render(request, 'analytics.html', {        'total_views': request.session['total_views'],        'page_views': page_views,        'last_visited': last_visited    })

Session Security

Best Practices

# 1. Use HTTPS in productionSESSION_COOKIE_SECURE = True  # Requires HTTPS # 2. Prevent JavaScript accessSESSION_COOKIE_HTTPONLY = True # 3. CSRF protectionSESSION_COOKIE_SAMESITE = 'Lax'  # or 'Strict' # 4. Rotate session ID after loginfrom django.contrib.auth import login def login_view(request):    user = authenticate(username=username, password=password)    if user:        # Cycle session key (new session ID)        request.session.cycle_key()        login(request, user) # 5. Clear sensitive datadef sensitive_operation(request):    # Store temporarily    request.session['temp_token'] = token        # Use it    process_with_token(request.session['temp_token'])        # Clear immediately    del request.session['temp_token'] # 6. Set appropriate expiry# Short expiry for sensitive operationsrequest.session.set_expiry(300)  # 5 minutes # 7. Validate session datadef validate_session(request):    user_id = request.session.get('user_id')    if user_id:        # Verify user still exists and is active        try:            user = User.objects.get(pk=user_id, is_active=True)        except User.DoesNotExist:            request.session.flush()            return redirect('login')

Bài Tập

Bài 1: Shopping Cart

Task: Implement complete shopping cart:

# Features:# 1. Add product to cart (with quantity)# 2. View cart with product details and images# 3. Update quantity in cart# 4. Remove item from cart# 5. Clear entire cart# 6. Display cart item count in navbar (all pages)# 7. Calculate subtotal and total# 8. Apply discount code (store in session)# 9. Persist cart if user logs in# 10. Checkout and clear cart # Bonus:# - Save cart to database when user logs in# - Restore cart from database on next login# - Set cart expiry (7 days)

Bài 2: Multi-Step Registration

Task: Create 3-step registration form:

# Step 1: Account (username, email, password)# Step 2: Profile (name, birth_date, phone)# Step 3: Preferences (newsletter, language, timezone) # Requirements:# - Store data in session between steps# - Allow going back to edit previous steps# - Validate each step before proceeding# - Show progress indicator (Step 1/3, 2/3, 3/3)# - Final step: review all data and confirm# - Save everything to database on confirmation# - Clear session after completion# - Handle session expiry (redirect to step 1)

Bài 3: User Preferences

Task: Implement user preferences with cookies:

# Preferences to save:# - Theme (light/dark)# - Language (en/vi)# - Items per page (10/25/50)# - Sidebar collapsed/expanded # Requirements:# 1. Preference settings page# 2. Apply preferences across all pages# 3. Use cookies (1 year expiry)# 4. JavaScript to toggle without page reload# 5. Ajax to save preferences# 6. If logged in, save to database# 7. Priority: Database > Cookies > Defaults

Bài 4: Recently Viewed Products

Task: Track recently viewed products:

# Requirements:# 1. Store last 10 viewed products in session# 2. Display "Recently Viewed" section on product pages# 3. Don't show current product in recently viewed# 4. Remove duplicates (keep most recent)# 5. Clear history button# 6. Show view count per product (session)# 7. Track view time and duration # Bonus:# - Save to database if user logs in# - Use for recommendations# - Analytics dashboard showing popular products

Tài Liệu Tham Khảo

Previous: Bài 14: Authentication Basics | Next: Bài 16: Messages Framework

#cookies

Django Sessions and Cookies