扭曲的会话Cookie正在更改为每个请求

由于某种原因登录后，每个POST请求后Twisted会话cookie更改。为什么会发生？我希望会话uid是相同的，直到连接丢失或用户注销。扭曲的会话Cookie正在更改为每个请求

这里是我的代码，使会议成为每个请求的不同：

from twisted.web.server import Site, http 
from twisted.internet import reactor 
from twisted.web.resource import Resource 

import json 

class HttpResource(Resource): 
    isLeaf = True 

    def render_OPTIONS(self, request): 
     request.setHeader('Access-Control-Allow-Origin', '*') 
     request.setHeader('Access-Control-Allow-Headers', 'Origin, Accept, content-type, authorization') 
     return "" 

    def render_GET(self, request): 
     request.setHeader('Access-Control-Allow-Origin', '*') 
     request.setHeader('Access-Control-Allow-Headers', 'Origin, Accept, content-type, authorization') 
     return "<html><body style='margin: 0; overflow: hidden;'><iframe style='width: 100%; height: 100%; border: none;' src='http://tsa-graphiql.herokuapp.com/'></iframe></body></html>" 

    def render_POST(self, request): 
     request.setHeader('Access-Control-Allow-Origin', '*') 
     request.setHeader('Access-Control-Allow-Headers', 'Origin, Accept, content-type, authorization') 

     session_id = request.getSession().uid 
     print "HttpResource session ID: {}".format(session_id) 


class LoginResource(Resource): 
    isLeaf = True 

    def render_OPTIONS(self, request): 
     request.setHeader('Access-Control-Allow-Origin', '*') 
     request.setHeader('Access-Control-Allow-Headers', 'Origin, Accept, content-type, authorization') 
     return "" 

    def render_GET(self, request): 
     request.setHeader('Access-Control-Allow-Origin', '*') 
     request.setHeader('Access-Control-Allow-Headers', 'Origin, Accept, content-type, authorization') 
     return "<html><body style='margin: 0; overflow: hidden;'><iframe style='width: 100%; height: 100%; border: none;' src='http://tsa-graphiql.herokuapp.com/'></iframe></body></html>" 

    def render_POST(self, request): 
     log("Login request") 
     request.setHeader('Access-Control-Allow-Origin', '*') 
     request.setHeader('Access-Control-Allow-Headers', 'Origin, Accept, content-type, authorization') 

     req = request.content.read() 

     session_id = request.getSession().uid 

     try: 
      jsQ = json.loads(req) 
     except Exception as e: 
      return e 

     # User credentials 
     username = jsQ['username'] 
     password = jsQ['password'] 

     # Authenticate the User 
     if username == 'test' and password == 'test': 
      # Create a new session 
      print "Login session ID: {}".format(session_id) 
     else: 
      request.setResponseCode(401) 
      return "Invalid username or password" 


class RefreshResource(Resource): 
    isLeaf = True 

    def render_OPTIONS(self, request): 
     request.setHeader('Access-Control-Allow-Origin', '*') 
     request.setHeader('Access-Control-Allow-Headers', 'Origin, Accept, content-type, authorization') 
     return "" 

    def render_GET(self, request): 
     request.setHeader('Access-Control-Allow-Origin', '*') 
     request.setHeader('Access-Control-Allow-Headers', 'Origin, Accept, content-type, authorization') 
     return "<html><body style='margin: 0; overflow: hidden;'><iframe style='width: 100%; height: 100%; border: none;' src='http://tsa-graphiql.herokuapp.com/'></iframe></body></html>" 

    def render_POST(self, request): 
     request.setHeader('Access-Control-Allow-Origin', '*') 
     request.setHeader('Access-Control-Allow-Headers', 'Origin, Accept, content-type, authorization') 
     print "Refresh session ID: {}".format(request.getSession().uid) 


class HttpFactory(Site): 

    def __init__(self, resource): 
     http.HTTPFactory.__init__(self) 
     self.resource = resource 
     self.sessions = {} 
     self.user_info = {} 


if __name__ == '__main__': 

    root = Resource() 
    root.putChild("", HttpResource()) 
    root.putChild("login", LoginResource()) 
    root.putChild("refresh", RefreshResource()) 

    site = HttpFactory(root) 
    reactor.listenTCP(8000, site) 

    reactor.run()

来源

2017-07-17 Brian

扭曲的Web会话是基于Cookie。为了使会话保持对客户端的激活，他们必须遵守服务器的响应（保存cookie并在未来的请求中重新发送）。

如果你的客户是像卷曲，然后：

$ curl http://localhost:8000/

将运行后丢弃会话cookie。如果再次运行该命令，您将得到一个新会话，因为客户端不会发送会话cookie，并且服务器无法知道请求属于先前创建的会话。

如果你告诉卷曲用这样的命令通常处理Cookie：

$ curl --cookie session-cookies --cookie-jar session-cookies http://localhost:8000/

然后卷曲将保存会话cookie的服务器组。如果您再次运行该命令，则会将会话cookie发送回服务器，您将看到重复使用的会话。

来源

2017-07-19 13:12:35

好吧，我明白了。因此，如果扭曲的代码在标头中设置cookie，那么UI应该向每个请求发送该cookie，直到会话结束。谢谢你的解释Jean！ – Brian

扭曲的会话Cookie正在更改为每个请求

回答

相关问题