Python Pyramid AuthTktAuthenticationPolicy 基于不活动问题的自动过期 cookie

Question

请有人帮忙。我是金字塔的新手。所以根据金字塔文档关于AuthTktAuthenticationPolicy

开发人员说我们可以根据不活动设置自动过期的 cookie - 太棒了。 但这对我不起作用，所以它说您需要使用 reissue_time 参数并将其与 timeout 配对设置。例如，如果 timeout 设置为 1200，那么 reissue_time 应该是 timout / 10 = 120，2 分钟。 据我了解，重点是在用户处于非活动状态 2 分钟后自动注销。但是当我尝试重新加载页面令牌或会话没有过期。

#myapp/__init__.py
from pyramid.config import Configurator
from sqlalchemy import engine_from_config

from myapp.models import initialize_sql
from myapp import views
from pyramid.authentication import AuthTktAuthenticationPolicy
from pyramid.authorization import ACLAuthorizationPolicy


def main(global_config, **settings):
    """ This function returns a Pyramid WSGI application.
    """
    authentication_policy = AuthTktAuthenticationPolicy(secret='secret', hashalg='sha512', timeout=1200, reissue_time=120)
    authorization_policy = ACLAuthorizationPolicy()
    config = Configurator(settings=settings, root_factory='myapp.factory.RootFactory', )
    config.include('pyramid_jinja2')
    #config.add_jinja2_renderer('.html', settings_prefix='jinja2.')
    config.add_static_view('static', 'static', cache_max_age=3600)
    config.scan('myapp.models')
    config.set_authentication_policy(authentication_policy)
    config.set_authorization_policy(authorization_policy)
    engine = engine_from_config(settings, 'sqlalchemy.')
    initialize_sql(engine)
    views.routes(config)
    return config.make_wsgi_app()

#factory/rootfactory.py
from pyramid.security import (
    Allow,
    Authenticated,
    )


class RootFactory(object):
    '''Root factory class. Acl auth system'''

    __acl__ = [(Allow, Authenticated, 'view'),]

    def __init__(self, request):
        pass

#views/__init__.py
def routes(config):

 config.add_route('home', '/')
 config.add_route('login', '/login')
 config.add_route('logout', '/logout')

config.scan('myapp')

#views/auth.py
from pyramid.response import Response
from pyramid.security import remember, forget, authenticated_userid
from pyramid.httpexceptions import HTTPFound, HTTPForbidden

from pyramid.view import view_config, forbidden_view_config

from sqlalchemy.exc import DBAPIError

from ..models import DBSession
from ..models.user import User

from ..forms.login import LoginForm


@view_config(route_name='login', renderer='myapp:templates/login.jinja2')
@forbidden_view_config(renderer='myapp:templates/login.jinja2')
def login_view(request):
    if request.authenticated_userid:
        return HTTPFound(location=request.application_url)
    next = request.params.get('next') or request.route_url('home')
    login_form = LoginForm(request.POST)
    if request.method == 'POST' and login_form.validate():
        login = request.params.get('login', '')
        password = request.params.get('password', '')
        user = User.by_login(login)
        if user and user.validate_password(password):
            headers = remember(request, login)
            return HTTPFound(location=next, headers=headers)
    return {'form': login_form}


@view_config(route_name='logout', renderer='myapp:templates/logout.jinja2')
def logout_view(request):
    headers = forget(request)
    loc = request.route_url('login')
    return HTTPFound(location=loc, headers=headers)

#views/home.py
from pyramid.security import authenticated_userid
from pyramid.httpexceptions import HTTPForbidden
from pyramid.response import Response
from pyramid.view import view_config

from sqlalchemy.exc import DBAPIError

from ..models import DBSession
from ..models.user import User


@view_config(route_name='home', permission='view', renderer='myapp:templates/base.jinja2')
def home_view(request):

    return Response('Ok')

Answer 1

您的会话在 1200 秒或 20 分钟后注销。最多每 120 秒或 2 分钟，您就会收到一个新的 cookie。

换句话说，reissue_time 仅限制新令牌的发行频率。如果用户非常频繁地联系服务器，那么继续发行新令牌的成本将很高。相反，仅当旧令牌至少存在 reissue_time 秒时才会发布新令牌。新令牌将在另一个timeout 秒内保持新鲜，因此每次重新发出都会延长会话。

只有当用户使用超过timeout 秒的 cookie 与服务器联系时，会话才不再有效。