openedx / openedx/openedx-platform
Sessions are cleared and users are logged out when cache is cleared
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 8.2k
- Forks
- 4.4k
- Avg merge
- 6d 18h
- Merged PRs (30d)
- 42
Description
At this time, when the edx-platform cache (e.g. Memcached or Redis) loses its data, all user sessions are lost and everyone is logged out. This is probably a frustrating experience for users, and also hammers servers with logins until users have restored there sessions.
The solution is probably to use a db-backed cache.
See Using database-backed sessions and see cached_db details in Using cached sessions.
Question:
- Is there any security issue with these in the DB? Could anyone with DB access take over a session? Or do the sessions get encrypted?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No repository file or test is identified. Start by reading Django's linked documentation on database-backed and cached sessions, then inspect the project's session and cache configuration to determine the security implications and whether cache loss can be tolerated. Done means sessions survive cache eviction and the database-storage security question is resolved.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- django, memcached, python, redis
- Domain
- authentication, backend, databases
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 28/100