I’m using gae-sessions. The client is an iOS application, and I want sessions to persist for the lifetime of the app (so the only way a session expires or is invalid is when the user logs out or the user deletes the app, other wise the session has no expiration date). I don’t think I want to use cookies, as cookies are short lived (or should I?)
So what I’m doing is creating a new session, get the automatically generated SID for that session (session id, a random string), and sending that string back to the client and saving it there for good. Now every time the user sends a request, the session id is also sent over, and I get the current session using this id:
# gets the session with given session id
session = gaesessions.Session(sid = session_id)
First, is anything wrong with this approach? Is there a better way to do this?
Now, when the user logs out, it’s easy to submit a request to invalidate the session with the given id. However, if the user deletes the app, I’ll have no way of ever getting that session and deleting it. So how would I clean up no longer valid sessions?
I’m wondering why you need a session at all. Just store the data in some per-user object in the datastore. Then it’s easy to refer to that user. I’m assuming you’re already storing some sort of user data other than the session.
This answer doesn’t solve the problem though, you never know if a user deletes the app, so you’ll have that user data around forever. This is more of a policy question than a tech question.
If you do want to delete the user data, you’ll need to set some sort of policy (ie, if you haven’t logged-in in 2 years, we’re deleting your account). In which case, your expire is essentially 2 years. You’ll need a cron job that runs periodically ane clean out expired Users (or session).
Btw, gae-sessions includes example cleanup code for expired sessions, including a cron handler.