Mercurial > p > roundup > code
changeset 8504:e331be9bc473
doc: add note that we can't incrementally clean old records from db
The clean operation can take a while. I considered setting a time
limit so it would clean as many records as it can within a time limit
(e.g. 2 seconds) and then return from clean.
However the callers expect that all old record are removed so that
looking for a matching session key, csrf key etc. will match ONLY
unexpired records. They don't check the __timestamp returned.
So clean MUST destroy all expired records before returning.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Mon, 22 Dec 2025 12:26:03 -0500 |
| parents | 0ad1e7d563a6 |
| children | 299edbd03ddf |
| files | roundup/backends/sessions_dbm.py |
| diffstat | 1 files changed, 4 insertions(+), 0 deletions(-) [+] |
line wrap: on
line diff
--- a/roundup/backends/sessions_dbm.py Mon Dec 22 12:21:33 2025 -0500 +++ b/roundup/backends/sessions_dbm.py Mon Dec 22 12:26:03 2025 -0500 @@ -201,6 +201,10 @@ def clean(self): ''' Remove session records that haven't been used for a week. ''' + ''' Note: deletion of old keys must be completed when this method + returns. Calling code must not have any expired keys present + after this returns or expired keys could be used to validate + a user. This can mean a long delay when expiring but ....''' now = time.time() week = 60*60*24*7 a_week_ago = now - week