Comments (6)
thanks, solved for me !
from starsessions.
Well, the issue comes not from starsessions
but from Starlette's Request.session
typing. IIRC, it is declared as dict
so it is not fully compatible with this library which has more options (because some backends need to be loaded first before they can be accessed).
You have several workarounds here:
- use
typing.cast
function:if cast(Session, request.session).is_empty: ...
- create your own Request class with properly typed attributes and use it in your type hints.
I like the last point more as you may also want to type your request.state
variable.
If you have an alternate idea I would be glad to hear.
BTW, what is your usecase? You don't need to access "is_empty" usually.
from starsessions.
ok seems number 2 is indeed better !
BTW, what is your usecase? You don't need to access "is_empty" usually.
I'm on a task where I can only do only server-side rendering and I'm using it in a jinja2 template layout this way, not sure this is appropriate though :
{% if not request.session.is_empty %}
<li><a href="{{ url_for('get_me') }}">{{ request.session.data.username }}</a></li>
{% if 'admin' in request.session.data.roles %}
<li><a href="{{ url_for('admin')}}">Admin</a> </li>
{% endif %}
<li><a href="{{ url_for('logout') }}">Logout</a></li>
{% else %}
<li><a href="{{ url_for('register_get') }}">Register</a></li>
<li><a href="{{ url_for('login_get') }}">Login</a></li>
{% endif %}
from starsessions.
Well, Session.is_empty
checks that the session has no data. The SessionMiddleware will remove the session cookie if is_empty
returns True
.
Your use case is authentication and authorization. So you should use request.auth
or request.user
for this purpose.
https://www.starlette.io/authentication/ - load user
https://www.starlette.io/authentication/#authcredentials - for permissions
Your code can look like this:
{% if request.user %}
{% if 'admin' in request.user.roles %}... {% endif %}
OR
{% if 'admin' in request.auth.scopes %}... {% endif %}
{% else %}
<!-- render login links -->
{% endif %}
from starsessions.
I'm not using starlette directly but fastapi, and this is early exploration so I'm not too sure yet on the design, but one contraint is that endpoints can be either restricted by roles or permissions in a rbac system
so my solution is to have a /login path that sets the username/role/permission in the session
and a class dependency that checks for the proper roles or perms and returns a 403 if that doesn't match what the given endpoint wants/needs
from starsessions.
Got you. Okay, the Session
class is dict-like. You can go like this:
if 'data' in request.session: ...
if 'admin' in request.session.get('data', []): ...
This will make mypy happier.
from starsessions.
Related Issues (20)
- Move serializer from backend into middleware
- Clean Session class interface
- Remove `secret_key` from middleware and require users to explicitly define backend instance. HOT 1
- `session_id` must be always required in backend methods.
- Add encryptors
- Session cookie must always expire at max-age
- Replace `autoload` with extra middleware
- Explore option to store session metadata in session
- Drop `max_age` from cookie and redis backends.
- Replace `redis_key_func` with `prefix`
- Rename `Backend` to `Store`
- Middleware has to have strict defaults.
- Regression on v2: session dict is lost after a redirect using httpx client HOT 4
- Potential issue with default values HOT 1
- Separate rolling time extension from lifetime HOT 1
- Request.session should be typed HOT 2
- aioredis dependency HOT 1
- Issue with SessionAutoloadMiddleware HOT 5
- session invalidation with redis HOT 8
- Session does not work when mounting routes HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from starsessions.