django 使用remote user 登录后，为什么登录状态无法保持

Question

我想用django实现第三方认证获取到用户名后，再携带登录信息返回主页，但是发现登录后的session再返回主页后总是无法关联，session会被自动删除，通过cookie记录的sessionID是正确的。

1. 我的代码：
   View.py

   def ding_back(request):
    username="REMOTE"
    request.META['REMOTE_USER']=username
    user=authenticate(request,remote_user=username)
    login(request,user)
    if request.user.is_authenticated:
        print(request.user)
        print("HASH_SESSION_KEY: "+request.session.get('_auth_user_hash'))
        print("SESSION_KEY: "+request.session.get('_auth_user_id'))
        print("BACKEND_SESSION_KEY: "+request.session['_auth_user_backend'])
        print("sessionID: "+str(request.session.session_key))
        return HttpResponse("登录成功")
   def index(request):
        print("Login?:"+str(request.user.is_authenticated))
        print(request.COOKIES)
        print("HASH_SESSION_KEY: " + request.session.get('_auth_user_hash'))
        print("SESSION_KEY: " + request.session.get('_auth_user_id'))
        print("BACKEND_SESSION_KEY: " + request.session['_auth_user_backend'])
   

   Url.py

urlpatterns=[
    path('',views.index,name='index'),
    path('dingding_back/',views.ding_back,name='ding_back'),

1. 登录

• 首先通过http://127.0.0.1:8000/orders/dingding_back/ 登录
  返回登录成功：
  

  

  
  输出：

  REMOTE
  HASH_SESSION_KEY: 9aaa98105dce79dde166f46c646502940e418294622f70cf8cbb3aeb34067764
  SESSION_KEY: 4
  BACKEND_SESSION_KEY: django.contrib.auth.backends.RemoteUserBackend
  sessionID: 1dcyas6jju18ounfwflpjhwcuz0a3kev
  

• 浏览器记录的cookie：

数据库记录的session:

+----------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------------------------+
| session_key                      | session_data                                                                                                                                                                                                                                | expire_date                |
+----------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------------------------+
| 1dcyas6jju18ounfwflpjhwcuz0a3kev | .eJxVjMEOwiAQRP-FsyHQbpfi0U8w8dwssEg1lqTQk_HfpUkPeppkZt57i4m2mqat8DrNQZwFiNNv58g_edmH8KDlnqXPS11nJ_eLPNYir_zKlW-NuBzAnyVRSU1hiciOWg3Bs7EhsEaMgB4BB9VZUAx6bIldF43ycfTO9cSuB4XGIIjPFzQoOWo:1mXzly:9yhjgESDVnM9esU2yO6TGW05cckAK-cZIse_nhIW_Uo | 2021-10-20 13:47:22.394248 |
+----------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------------------------+

1. 返回主页

• 输出（cookie没有匹配到对应的session）：

  Login?:False
  {'csrftoken': '3Lnsd2dRQi8fyRbBapCEeI22YolfyREKK8aOYWuKH18l66V5U6b3CdErzmvWb7r2', 'sessionid': '1dcyas6jju18ounfwflpjhwcuz0a3kev'}
  

• 浏览器中的cookie被删除

• 数据库中的session被删除：

MariaDB [db_mysite]> select * from django_session;
Empty set (0.000 sec)

返回主页没有根据sessionID获取到登陆的信息，请帮忙看看是怎么回事？

Answer 1

实现第三方认证不能使用session，改为token技术+redis实现。