Skip to content

Conversation

@Zaczero
Copy link
Contributor

@Zaczero Zaczero commented Nov 6, 2025

Closes #2019, Requires #3068

Summary

Utilize the new TimestampSigner to obtain timestamp information, and in combination with a simple equality check, reduce the frequency of set-cookie responses. The set-cookie is sent whenever:

  • Session data changes
  • Session data is older than 1/4 of max_age

I have additionally corrected the handling of max_age so in the unrealistic edge case of 0 it will treat it as configured value. This is also how itsdangerous handles it, so the current implementation is buggy in that sense.

Checklist

  • I understand that this PR may be closed in case there was no previous discussion. (This doesn't apply to typos!)
  • I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
  • I've updated the documentation accordingly.

@Zaczero Zaczero changed the title No itsdangerous no setcookie Reduce the frequency of set-cookie in SessionMiddleware Nov 6, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

SessionMiddleware sends a new set-cookie for every request, with unintended results

1 participant