SVN: r23390 - trunk/quixote

Author: nascheme
Date: 2004-02-03 12:22:04 -0500 (Tue, 03 Feb 2004)
New Revision: 23390

Modified:
   trunk/quixote/config.py
   trunk/quixote/session.py
Log:
Change the behavior of session cookies if SESSION_COOKIE_PATH is
unset.  The old behavior was to not set the 'path' attribute of the
session cookie.  The new behavior is to use SCRIPT_NAME.  Also, set
the 'path' attribute when revoking the session cookie.  Some browsers
treat it as a separate cookie if it has a different path.


Modified: trunk/quixote/config.py
===================================================================
--- trunk/quixote/config.py	2004-02-03 16:04:33 UTC (rev 23389)
+++ trunk/quixote/config.py	2004-02-03 17:22:04 UTC (rev 23390)
@@ -100,10 +100,13 @@
 # Name of the cookie that will hold the session ID string.
 SESSION_COOKIE_NAME = "QX_session"
 
-# Domain and path to which the session cookie is restricted.  It's
-# usually fine to leave these undefined -- the browser should then only
-# send the cookie to pages "under" the page that originally set the
-# cookie -- see RFC 2965, sec. 3.3.
+# Domain and path to which the session cookie is restricted.  Leaving
+# these undefined is fine.  Quixote does not have a default "domain"
+# option, meaning the session cookie will only be sent to the
+# originating server.  If you don't set the cookie path, Quixote will
+# use your application's root URL (ie. SCRIPT_NAME in a CGI-like
+# environment), meaning the session cookie will be sent to all URLs
+# controlled by your application, but no other.
 SESSION_COOKIE_DOMAIN = None    # eg. ".example.com"
 SESSION_COOKIE_PATH = None      # eg. "/"
 

Modified: trunk/quixote/session.py
===================================================================
--- trunk/quixote/session.py	2004-02-03 16:04:33 UTC (rev 23389)
+++ trunk/quixote/session.py	2004-02-03 17:22:04 UTC (rev 23390)
@@ -339,16 +339,27 @@
             # repeatedly storing the same object in the same mapping.
             self[session.id] = session
 
+    def _set_cookie (self, request, value, **attrs):
+        config = get_publisher().config
+        name = config.session_cookie_name
+        if config.session_cookie_path:
+            path = config.session_cookie_path
+        else:
+            path = request.environ['SCRIPT_NAME']
+            if not path.endswith("/"):
+                path += "/"
+        domain = config.session_cookie_domain
+        request.response.set_cookie(name, value, domain=domain,
+                                    path=path, **attrs)
+        return name
+        
     def set_session_cookie (self, request, session_id):
         """set_session_cookie(request : HTTPRequest, session_id : string)
 
         Ensure that a session cookie with value 'session_id' will be
         returned to the client via 'request.response'.
         """
-        config = get_publisher().config
-        request.response.set_cookie(config.session_cookie_name, session_id,
-                                    domain = config.session_cookie_domain,
-                                    path = config.session_cookie_path)
+        self._set_cookie(request, session_id)
 
     def revoke_session_cookie (self, request):
         """revoke_session_cookie(request : HTTPRequest)
@@ -358,14 +369,9 @@
         remove the cookie from 'request' so that further processing of
         this request does not see the cookie's revoked value.
         """
-        config = get_publisher().config
-        response = request.response
-        response.set_cookie(config.session_cookie_name, "",
-                            domain = config.session_cookie_domain,
-                            path = config.session_cookie_path,
-                            max_age = 0)
-        if request.cookies.has_key(config.session_cookie_name):
-            del request.cookies[config.session_cookie_name]
+        cookie_name = self._set_cookie(request, "", max_age=0)
+        if request.cookies.has_key(cookie_name):
+            del request.cookies[cookie_name]
 
     def expire_session (self, request):
         """expire_session(request : HTTPRequest)