DEV Community

Cover image for Implementing Basic Session Management in a Lightweight Python Web Framework
HexShift
HexShift

Posted on

Implementing Basic Session Management in a Lightweight Python Web Framework

#python #webdev #programming

Sessions allow your web framework to maintain state between requests from the same client. This is crucial for features like login persistence, shopping carts, or user preferences.

What is a Session?

HTTP is stateless by design, meaning each request is independent. Sessions provide a way to associate multiple requests with a user by storing data on the server side and linking it via a session ID cookie.

How Sessions Work

  1. When a client connects, generate a unique session ID.
  2. Store session data on the server (in-memory, file, or database) keyed by that ID.
  3. Send the session ID back as a cookie.
  4. On subsequent requests, read the cookie to retrieve session data.

Generating Session IDs

Session IDs should be:

  • Unique
  • Hard to guess (secure)
  • Usually a long random string

Use Python’s secrets module:

import secrets

def generate_session_id():
    return secrets.token_hex(16)
Enter fullscreen mode Exit fullscreen mode

Storing Session Data

For a simple framework, use a dictionary:

sessions = {}
Enter fullscreen mode Exit fullscreen mode

Each session ID maps to a dict of user data:

sessions[session_id] = {"user_id": 123, "cart": []}
Enter fullscreen mode Exit fullscreen mode

Setting and Reading Cookies

When sending responses, include a Set-Cookie header:

Set-Cookie: session_id=abc123; Path=/; HttpOnly
Enter fullscreen mode Exit fullscreen mode

In incoming requests, parse the Cookie header:

def parse_cookies(headers):
    cookies = {}
    cookie_header = headers.get("Cookie", "")
    for pair in cookie_header.split(";"):
        if "=" in pair:
            key, value = pair.strip().split("=", 1)
            cookies[key] = value
    return cookies
Enter fullscreen mode Exit fullscreen mode

Middleware Example for Sessions

A middleware that loads or creates a session:

def session_middleware(request, next_handler):
    cookies = parse_cookies(request["headers"])
    session_id = cookies.get("session_id")

    if not session_id or session_id not in sessions:
        session_id = generate_session_id()
        sessions[session_id] = {}

    request["session"] = sessions[session_id]
    response = next_handler(request)

    # Add Set-Cookie header if new session created
    if "Set-Cookie" not in response.get("headers", {}):
        response.setdefault("headers", {})["Set-Cookie"] = f"session_id={session_id}; Path=/; HttpOnly"
    return response
Enter fullscreen mode Exit fullscreen mode

Using Sessions in Handlers

Handlers can access request["session"] to read or write session data:

def dashboard(request):
    user = request["session"].get("user")
    if not user:
        return {"status": 401, "body": b"Unauthorized"}
    return {"status": 200, "body": f"Welcome, {user}".encode()}
Enter fullscreen mode Exit fullscreen mode

Security Considerations

  • Use HttpOnly and Secure flags on cookies where appropriate
  • Implement session expiration and cleanup
  • Consider storing sessions outside memory for scalability
  • Protect against session fixation and hijacking

Wrap-Up

Adding basic session support to your lightweight framework enables persistent user experiences. While simple in concept, proper session management is key to building real-world web applications.

Want to dive deeper? Check out my 20-page PDF guide: Building a Lightweight Python Web Framework from Scratch

Top comments (0)