如何在Tornado RequestHandler中存储数据库会话

Question

I'm implementing a secure cookie scheme for user session management in Tornado. The user's details are accessed via SQLAlchemy. Currently I need to open two database sessions: one to verify that a user exists during authentication, and another to query other parts of the model. Something like this:

class BaseHandler(tornado.web.RequestHandler):
    def get_current_user(self):
        user_id = self.get_secure_cookie('user')
        if not user_id:
            return None
        with model.session_scope() as session:
            user = session.query(model.AppUser).get(user_id)
            if not user:
                return None
            session.expunge(user)
        return user

class OtherHandler(BaseHandler):
    @tornado.web.authenticated
    @gen.coroutine
    def put(self, ob_id):
        with model.session_scope() as session:
             other = session.query(model.Other).get(ob_id)
             session.merge(self.current_user)
             if not user.can_view(other):
                 raise AuthzError
             yield self.some_operation(other)
        self.finish()

It would be nice if I didn't have to use merge to bring the user object back into the session. Is there a safe way to store the database session and persistent user object in the handler? I'm considering doing something like this:

class BaseHandler(tornado.web.RequestHandler):
    def prepare(self):
        self.session = model.Session()
        user_id = self.get_secure_cookie('user')
        if user_id:
            self.current_user = session.query(model.AppUser).get(user_id)

    def finish(self, chunk=None):
        try:
            return super().finish(chunk)
        finally:
            self.session.commit()

    def send_error(self, status_code=500, **kwargs):
        try:
            return super().send_error(status_code=status_code, **kwargs)
        finally:
            self.session.rollback()

Questions:

1. Is it safe to store the session (or anything else) in self , even when using async code ( @gen.coroutine and yield )?
2. Is the way I'm closing the session in finish and send_error robust ? I want to make sure I don't have any zombie sessions hanging around.

Answer 1

Is the way I'm closing the session in finish and send_error robust? I want to make sure I don't have any zombie sessions hanging around

You can use either on_finish or on_connection_close .

def on_finish(self):
    if self.get_status_code() >= 500:
        self.session.rollback()
    else:
        self.session.commit()

Note that may exist a better way to distinguish an error response. Also take a look at the discussion - https://github.com/tornadoweb/tornado/issues/517

Is it safe to store the session (or anything else) in self, even when using async code (@gen.coroutine and yield)?

The RequestHandler object is created for every request, it's not shared. Asynchronous in that context, does not make the code more vulnerable (I think) to store data in " self ".