HorizonMiddleware class causes excessive session creation

[Eric Peterson]

In HorizonMiddleware there are several session fields that get addressed / setup that can create sessions. If there is any type of health check script (which does not maintain sessions) that hits a non authenticated url, then many sessions will be created.

If using cookie backed sessions this is less of an issue, but when using db backed session stores the session count grows too large very quickly.

Propose to place the session field modification in a block with if request.user.is_authenticated(): around it.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/41568

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/41568
Committed: http://github.com/openstack/horizon/commit/a62944985d12b5ed516e5fdaf97bb4083c55da41
Submitter: Jenkins
Branch: master

commit a62944985d12b5ed516e5fdaf97bb4083c55da41
Author: ericpeterson-l <email address hidden>
Date: Mon Aug 12 16:37:05 2013 -0600

    Fix middleware to not access session fields without user auth

    Change-Id: I18bccfa900b25b3ccb1f2514b2c5c0450b54af2d
    Fixes: bug #1211535

[Lin Hua Cheng (lin-hua-cheng)]

Moving status back to confirmed, the patch has been reverted due to tempest job failing: https://review.openstack.org/#/c/42033/

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/42240

[Julie Pichon (jpichon)]

It would be nice to have a version of the original patch in Horizon as well, as currently we're calculating session timeout even when idling on the login page, which is surprising.

[Julie Pichon (jpichon)]

Current django_openstack_auth patch at https://review.openstack.org/#/c/42147/

[Gabriel Hurley (gabriel-hurley)]

I've pushed 1.1.3 of django_openstack_auth to PyPI. I believe that makes this done now.

[Gabriel Hurley (gabriel-hurley)]

Note: we are now looking at this review again: https://review.openstack.org/#/c/42240/

[David Lyle (david-lyle)]

I'm not super confident in this one at this late date. If there's anything wrong with it, it's location is too fundamental to be benign. I'd prefer to bump this one to Icehouse.

[Gabriel Hurley (gabriel-hurley)]

Since this turned out to have further issues (described on the review) this doesn't look safe for RC2. Pushing back to I1 to be fully addressed there.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/42240
Committed: https://git.openstack.org/cgit/openstack/horizon/commit/?id=2364b695c2b37b08ac1cec75f98a5c6364908ef7
Submitter: Jenkins
Branch: master

commit 2364b695c2b37b08ac1cec75f98a5c6364908ef7
Author: ericpeterson-l <email address hidden>
Date: Thu Aug 15 17:13:22 2013 -0600

    Fix middleware to not access session fields without user auth

    Change-Id: Idc2b71aa9ca08570e870ac6e356211dfbaa7a726
    Fixes: bug #1211535