aiohttp-session

aiohttp_session

https://readthedocs.org/projects/aiohttp-session/badge/?version=latest

https://img.shields.io/pypi/v/aiohttp-session.svg

The library provides sessions for aiohttp.web.

Usage

The library allows us to store user-specific data into a session object.

The session object has a dict-like interface (operations like session[key] = value, value = session[key] etc. are present).

Before processing the session in a web-handler, you have to register the session middleware in aiohttp.web.Application.

A trivial usage example:

import time
from cryptography import fernet
from aiohttp import web
from aiohttp_session import setup, get_session
from aiohttp_session.cookie_storage import EncryptedCookieStorage


async def handler(request):
    session = await get_session(request)
    last_visit = session['last_visit'] if 'last_visit' in session else None
    session['last_visit'] = time.time()
    text = 'Last visited: {}'.format(last_visit)
    return web.Response(text=text)


def make_app():
    app = web.Application()
    fernet_key = fernet.Fernet.generate_key()
    f = fernet.Fernet(fernet_key)
    setup(app, EncryptedCookieStorage(f))
    app.router.add_get('/', handler)
    return app


web.run_app(make_app())

All storages use an HTTP Cookie named AIOHTTP_SESSION for storing data. This can be modified by passing the keyword argument cookie_name to the storage class of your choice.

Available session storages are:

aiohttp_session.SimpleCookieStorage() – keeps session data as a plain JSON string in the cookie body. Use the storage only for testing purposes, it’s very non-secure.
aiohttp_session.cookie_storage.EncryptedCookieStorage(secret_key) – stores the session data into a cookie as SimpleCookieStorage but encodes it via AES cipher. secrect_key is a bytes key for AES encryption/decryption, the length should be 32 bytes.

Requires cryptography library:
```
$ pip install aiohttp_session[secure]
```
aiohttp_session.redis_storage.RedisStorage(redis_pool) – stores JSON encoded data in redis, keeping only the redis key (a random UUID) in the cookie. redis_pool is a redis object, created by await aioredis.from_url(...) call.

$ pip install aiohttp_session[aioredis]

Developing

Install for local development:

$ make setup

Run linters:

$ make lint

Run tests:

$ make test

Third party extensions

License

aiohttp_session is offered under the Apache 2 license.

2.12.1 (2024-09-25)

Minor typing fix for aiohttp 3.10+.
Dropped support for Python 3.7. Started testing on 3.11 - 3.13.

2.12.0 (2022-10-28)

Migrated from aioredis to redis (if using redis without installing aiohttp-session[aioredis] then it will be necessary to manually install redis).

2.11.0 (2021-01-31)

Support initialising EncryptedCookieStorage with Fernet object directly.
Fix an issue where the session would get reset before the cookie expiry.

2.10.0 (2021-12-30)

Typing support
Add samesite cookie option
Support aioredis 2

2.9.0 (2019-11-04)

Fix memcached expiring time (#398)

2.8.0 (2019-09-17)

Make this compatible with Python 3.7+. Import from collections.abc, instead of from collections. (#373)

2.7.0 (2018-10-13)

Reset a session if the session age > max_age (#331)
Reset a session on TTL expiration for EncryptedCookieStorage (#326)

2.6.0 (2018-09-12)

Create a new session if NaClCookieStorage cannot decode a corrupted cookie (#317)

2.5.0 (2018-05-12)

Add an API for requesting new session explicitly (#281)

2.4.0 (2018-05-04)

Fix a bug for session fixation (#272)

2.3.0 (2018-02-13)

Support custom encoder and decoder by all storages (#252)
Bump to aiohttp 3.0

2.2.0 (2018-01-31)

Fixed the formatting of an error handling bad middleware return types. (#249)

2.1.0 (2017-11-24)

Add session.set_new_identity() method for changing identity for a new session (#236)

2.0.1 (2017-11-22)

Replace assertions in aioredis installation checks by RuntimeError (#235)

2.0.0 (2017-11-21)

Update to aioredis 1.0+. The aiohttp-session 2.0 is not compatible with aioredis 0.X (#234)

1.2.1 (2017-11-20)

Pin aioredis<1.0 (#231)

1.2.0 (2017-11-06)

Add MemcachedStorage (#224)

1.1.0 (2017-11-03)

Upgrade middleware to new style from aiohttp 2.3+

1.0.1 (2017-09-13)

Add key_factory attribute for redis_storage (#205)

1.0.0 (2017-07-27)

Catch decoder exception in RedisStorage on data load (#175)
Specify domain and path on cookie deletion (#171)

0.8.0 (2016-12-04)

Use time.time() instead of time.monotonic() for absolute times (#81)

0.7.0 (2016-09-24)

Fix tests to be compatible with aiohttp upstream API for client cookies

0.6.0 (2016-09-08)

Add expires field automatically to support older browsers (#43)
Respect session.max_age in redis storage #45
Always pass default max_age from storage into session (#45)

0.5.0 (2016-02-21)

Handle cryptography.fernet.InvalidToken exception by providing an empty session (#29)

0.4.0 (2016-01-06)

Add optional NaCl encrypted storage (#20)
Relax EncryptedCookieStorage to accept base64 encoded string, e.g. generated by Fernet.generate_key.
Add setup() function
Save the session even on exception in the middleware chain

0.3.0 (2015-11-20)

Reflect aiohttp changes: minimum required Python version is 3.4.1
Use explicit ‘aiohttp_session’ package

0.2.0 (2015-09-07)

Add session.created property (#14)
Replaced PyCrypto with crypthography library (#16)

0.1.2 (2015-08-07)

Add manifest file (#15)

0.1.1 (2015-04-20)

Fix #7: stop cookie name growing each time session is saved

0.1.0 (2015-04-13)

First public release

Metadata

Release files for aiohttp-session 2.12.1

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for aiohttp-session 2.12.1
File	Size	Uploaded	Provenance
aiohttp_session-2.12.1.tar.gz	92.8 kB	Sep 25, 2024	Without provenance	Details

Built distribution (wheel)

Table of built distributions (wheels) for aiohttp-session 2.12.1
File	Interpreter	ABI	Platform	Reset
aiohttp_session-2.12.1-py3-none-any.whl 12.5 kB Sep 25, 2024 Without provenance	Python 3	none	any	Details

Total release size: 105.2 kB

Release files / aiohttp_session-2.12.1.tar.gz

Download URL	aiohttp_session-2.12.1.tar.gz
Size	92.8 kB
Tags	Source
SHA-256 checksum How to use checksums	`15e6e0288e9bcccd4b1d0c28aae9c20e19a252b12d0cb682223ca9c83180e899`
BLAKE2b-256 checksum How to use checksums	`c2c4d73a7f19b1bd3149ba5bccd22e3ab580c19e4d9fcb83114309e8385ab807`
Upload date	Sep 25, 2024
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/5.1.1 CPython/3.9.20`

Release files / aiohttp_session-2.12.1-py3-none-any.whl

Download URL	aiohttp_session-2.12.1-py3-none-any.whl
Size	12.5 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`654df46c3c9b73294312795f558c3bca4a85bfd3b01a8b744d984ae3958dce5f`
BLAKE2b-256 checksum How to use checksums	`1381a9ff9032bbe7632fce8812487efe32cee3c76bc0b3221561cd5b6954d876`
Upload date	Sep 25, 2024
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/5.1.1 CPython/3.9.20`

Security for aiohttp-session 2.12.1

Report project as malware

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

No provenance found

None of the files in this release were uploaded with provenance metadata.

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.