2

tl;dr: Python newbie, Django's session not propagated correctly while using HTTPS

I'm building a basic web service which rely on session/cookies to authentication an user.

During the first authentication, I configure a specific session like this:

request.session['userSecureId'] = "blabla"
return HttpResponseRedirect('http://localhost/secure',context)

At this point, a new session key has been added to django_session table. A basic b64 decode on the session_data field confirm the presence of 'userSecureId'

On my view, I check if this session exist like this:

if request.session.get('userSecureId'):
    # do something

If I try this on my local system (plain HTTP), it works great. So my next step was to run it on my remote server with SSL enabled. I've configured SESSION_COOKIE_SECURE = True on my settings.py but now, the value returned by 'userSecureId' is always None.

This is probably a newbie question, so any pointer will be appreciated =)

Additionally, If I print request.session.session_key I'm able to successfully retrieve the session key, meaning Django correctly detect my sessionid cookie, but can't decode the content of session_value

EDIT: I just tried accessing Django on my remote system (same configuration) and I'm facing the same issue. I have no idea why I can't run the session value. Code works using 127.0.0.1 w/o problem though

PERPO
  • 3,692
  • 1
  • 12
  • 19

1 Answers1

0

According to here and here

To share a session between HTTP and HTTPS (and cross domain also), you should set SESSION_COOKIE_DOMAIN in your settings.

SESSION_COOKIE_DOMAIN = '.example.com'
Community
  • 1
  • 1
alioguzhan
  • 6,979
  • 8
  • 42
  • 65
  • Thanks, but it did not help. My cookie is correctly detected by Django on port 443, but for some reason the session_value only returns 'None' – PERPO May 23 '16 at 21:31