Odoo中登入介面返回的session_id失效

odoo 版本: 12.0 社群版

登入介面 /web/session/authenticate

將返回結果中的session_id用作其他請求中的身份驗證,發現session_id已失效

然後神奇的發現返回的session_id和cookie中存的id不一致

百思不得其解的從原始碼裡找答案

登入方法執行的步驟

web/controllers/main.py 809
@http.route('/web/session/authenticate', type='json', auth="none")
def authenticate(self, db, login, password, base_location=None):
    request.session.authenticate(db, login, password)
    return request.env['ir.http'].session_info()

web/models/ir_http.py 21
 def session_info(self):
        user = request.env.user
        display_switch_company_menu = user.has_group('base.group_multi_company') and len(user.company_ids) > 1
        version_info = odoo.service.common.exp_version()
        return {
            "session_id": request.session.sid,
            "uid": request.session.uid,
            "is_system": user._is_system() if request.session.uid else False,
            "is_admin": user._is_admin() if request.session.uid else False,
            ...}
   
 

請求中所維護的session

odoo/http.py 1440

請求會先獲取session 通過setup_session
不存在則新封裝一個
session也可以通過請求頭X-Openerp-Session-Id進行指定

def setup_session(self, httprequest):
    # recover or create session
    session_gc(self.session_store)

    sid = httprequest.args.get('session_id')
    explicit_session = True
    if not sid:
        sid =  httprequest.headers.get("X-Openerp-Session-Id")
    if not sid:
       sid = httprequest.cookies.get('session_id')
       explicit_session = False
    if sid is None:
       httprequest.session = self.session_store.new()
    else:
       httprequest.session = self.session_store.get(sid)
    return explicit_session


 

當登入方法執行,session_id是新生成的一個/cookies中的一個值
而在get_response中,儲存了當前會話,預設是重新將當前使用者的session進行重新賦值

odoo/http.py 1416
def get_response(self, httprequest, result, explicit_session):
		...
        save_session = (not request.endpoint) or request.endpoint.routing.get('save_session', True)
        if not save_session:
            return response

        if httprequest.session.should_save:
            if httprequest.session.rotate:
                self.session_store.delete(httprequest.session)
                httprequest.session.sid = self.session_store.generate_key()
                if httprequest.session.uid:
                    httprequest.session.session_token = security.compute_session_token(httprequest.session, request.env)
                httprequest.session.modified = True
            self.session_store.save(httprequest.session)
 

返回的response中的session_id是新生成的

所以導致使用登入介面,返回的session_id已失效