扭曲的會話Cookie正在更改爲每個請求

由於某種原因登錄後，每個POST請求後Twisted會話cookie更改。爲什麼會發生？我希望會話uid是相同的，直到連接丟失或用戶註銷。扭曲的會話Cookie正在更改爲每個請求

這裏是我的代碼，使會議成爲每個請求的不同：

from twisted.web.server import Site, http 
from twisted.internet import reactor 
from twisted.web.resource import Resource 

import json 

class HttpResource(Resource): 
    isLeaf = True 

    def render_OPTIONS(self, request): 
     request.setHeader('Access-Control-Allow-Origin', '*') 
     request.setHeader('Access-Control-Allow-Headers', 'Origin, Accept, content-type, authorization') 
     return "" 

    def render_GET(self, request): 
     request.setHeader('Access-Control-Allow-Origin', '*') 
     request.setHeader('Access-Control-Allow-Headers', 'Origin, Accept, content-type, authorization') 
     return "<html><body style='margin: 0; overflow: hidden;'><iframe style='width: 100%; height: 100%; border: none;' src='http://tsa-graphiql.herokuapp.com/'></iframe></body></html>" 

    def render_POST(self, request): 
     request.setHeader('Access-Control-Allow-Origin', '*') 
     request.setHeader('Access-Control-Allow-Headers', 'Origin, Accept, content-type, authorization') 

     session_id = request.getSession().uid 
     print "HttpResource session ID: {}".format(session_id) 


class LoginResource(Resource): 
    isLeaf = True 

    def render_OPTIONS(self, request): 
     request.setHeader('Access-Control-Allow-Origin', '*') 
     request.setHeader('Access-Control-Allow-Headers', 'Origin, Accept, content-type, authorization') 
     return "" 

    def render_GET(self, request): 
     request.setHeader('Access-Control-Allow-Origin', '*') 
     request.setHeader('Access-Control-Allow-Headers', 'Origin, Accept, content-type, authorization') 
     return "<html><body style='margin: 0; overflow: hidden;'><iframe style='width: 100%; height: 100%; border: none;' src='http://tsa-graphiql.herokuapp.com/'></iframe></body></html>" 

    def render_POST(self, request): 
     log("Login request") 
     request.setHeader('Access-Control-Allow-Origin', '*') 
     request.setHeader('Access-Control-Allow-Headers', 'Origin, Accept, content-type, authorization') 

     req = request.content.read() 

     session_id = request.getSession().uid 

     try: 
      jsQ = json.loads(req) 
     except Exception as e: 
      return e 

     # User credentials 
     username = jsQ['username'] 
     password = jsQ['password'] 

     # Authenticate the User 
     if username == 'test' and password == 'test': 
      # Create a new session 
      print "Login session ID: {}".format(session_id) 
     else: 
      request.setResponseCode(401) 
      return "Invalid username or password" 


class RefreshResource(Resource): 
    isLeaf = True 

    def render_OPTIONS(self, request): 
     request.setHeader('Access-Control-Allow-Origin', '*') 
     request.setHeader('Access-Control-Allow-Headers', 'Origin, Accept, content-type, authorization') 
     return "" 

    def render_GET(self, request): 
     request.setHeader('Access-Control-Allow-Origin', '*') 
     request.setHeader('Access-Control-Allow-Headers', 'Origin, Accept, content-type, authorization') 
     return "<html><body style='margin: 0; overflow: hidden;'><iframe style='width: 100%; height: 100%; border: none;' src='http://tsa-graphiql.herokuapp.com/'></iframe></body></html>" 

    def render_POST(self, request): 
     request.setHeader('Access-Control-Allow-Origin', '*') 
     request.setHeader('Access-Control-Allow-Headers', 'Origin, Accept, content-type, authorization') 
     print "Refresh session ID: {}".format(request.getSession().uid) 


class HttpFactory(Site): 

    def __init__(self, resource): 
     http.HTTPFactory.__init__(self) 
     self.resource = resource 
     self.sessions = {} 
     self.user_info = {} 


if __name__ == '__main__': 

    root = Resource() 
    root.putChild("", HttpResource()) 
    root.putChild("login", LoginResource()) 
    root.putChild("refresh", RefreshResource()) 

    site = HttpFactory(root) 
    reactor.listenTCP(8000, site) 

    reactor.run()

來源

2017-07-17 Brian

扭曲的Web會話是基於Cookie。爲了使會話保持對客戶端的激活，他們必須遵守服務器的響應（保存cookie並在未來的請求中重新發送）。

如果你的客戶是像捲曲，然後：

$ curl http://localhost:8000/

將運行後丟棄會話cookie。如果再次運行該命令，您將得到一個新會話，因爲客戶端不會發送會話cookie，並且服務器無法知道請求屬於先前創建的會話。

如果你告訴捲曲用這樣的命令通常處理Cookie：

$ curl --cookie session-cookies --cookie-jar session-cookies http://localhost:8000/

然後捲曲將保存會話cookie的服務器組。如果您再次運行該命令，則會將會話cookie發送回服務器，您將看到重複使用的會話。

來源

2017-07-19 13:12:35

好吧，我明白了。因此，如果扭曲的代碼在標頭中設置cookie，那麼UI應該向每個請求發送該cookie，直到會話結束。謝謝你的解釋Jean！ – Brian

扭曲的會話Cookie正在更改爲每個請求

回答

相關問題