Session Authentication Basics
How Sessions Work
When a user logs in, Django creates a session record and sends the browser a sessionid cookie. Every later request uses that cookie to look up the session and find the logged-in user.
Example: How Sessions Work
request.session.session_key is the same value stored in the visitor's sessionid cookie, linking the browser to server-side session data.
def whoami(request):
print(request.session.session_key)
print(request.user)
return render(request, 'home.html')Storing Custom Data in a Session
Beyond login state, request.session behaves like a dictionary you can use to remember small pieces of per-visitor data.
Warning: Don't store large or sensitive data directly in the session — keep it small.
Example: Storing Custom Data in a Session
Anything assigned to request.session is automatically saved and available again on the visitor's next request.
def set_theme(request):
request.session['theme'] = 'dark'
return redirect('home')Session Expiry Settings
SESSION_COOKIE_AGE controls how many seconds a session cookie lasts before it expires.
Example: Session Expiry Settings
Without this setting, Django's default session cookie expires as soon as the browser is closed.
SESSION_COOKIE_AGE = 1209600 # 2 weeks, in seconds- Assuming sessions persist forever — by default Django's session cookie expires when the browser closes unless SESSION_COOKIE_AGE is configured.
- Manually reading cookies to check login state instead of relying on request.user, which Django already resolves from the session.
- Forgetting that logging out on one device doesn't automatically end sessions on other devices unless sessions are explicitly cleared.
- Django's session framework stores a per-visitor session ID in a cookie.
- The actual session data lives server-side (in the database by default), keyed by that session ID.
- login() writes the authenticated user's ID into the session; every later request reads it back via AuthenticationMiddleware.
- Sessions are what let request.user stay populated across multiple page loads.
Chapter Quiz — Complete all 12 topics to unlock
0/12 topics done
Complete these topics first:
- Introduction to Django's Auth System
- The User Model Overview
- Setting Up a Login View
- Logout Functionality
- User Registration Form
- The login_required Decorator
- The permission_required Decorator
- Django Groups and Permissions
- Password Hashing in Django
- Session Authentication Basics
- Introduction to Custom User Models
- Sending Emails with Django