2

tl;dr: Python newbie, Django's session not propagated correctly while using HTTPS

I'm building a basic web service which rely on session/cookies to authentication an user.

During the first authentication, I configure a specific session like this:

request.session['userSecureId'] = "blabla"
return HttpResponseRedirect('http://localhost/secure',context)

At this point, a new session key has been added to django_session table. A basic b64 decode on the session_data field confirm the presence of 'userSecureId'

On my view, I check if this session exist like this:

if request.session.get('userSecureId'):
    # do something

If I try this on my local system (plain HTTP), it works great. So my next step was to run it on my remote server with SSL enabled. I've configured SESSION_COOKIE_SECURE = True on my settings.py but now, the value returned by 'userSecureId' is always None.

This is probably a newbie question, so any pointer will be appreciated =)

Additionally, If I print request.session.session_key I'm able to successfully retrieve the session key, meaning Django correctly detect my sessionid cookie, but can't decode the content of session_value

EDIT: I just tried accessing Django on my remote system (same configuration) and I'm facing the same issue. I have no idea why I can't run the session value. Code works using 127.0.0.1 w/o problem though

PERPO
  • 3,812
  • 1
  • 13
  • 20

1 Answers1

0

According to here and here

To share a session between HTTP and HTTPS (and cross domain also), you should set SESSION_COOKIE_DOMAIN in your settings.

SESSION_COOKIE_DOMAIN = '.example.com'
Community
  • 1
  • 1
alioguzhan
  • 7,657
  • 10
  • 46
  • 67