如何在烧瓶中的不同会话之间进行通信

Question

here is an application case, my description is simplified.

here are 3 roles of a website: admin, moderator, and visitor

admin can control everything, moderator manages some part of the website, and visitors can post threads and read threads

the relationship of the users, roles and permissions are stored in the database in RBAC style

now admin want to downgrade a moderator to visitor, it's easy to manipulate the operation in the database.

but if the moderator is still online when this action is performed, there will be problem.

the admin and the moderator have two different session, and to accelerate the website speed, normally we put the roles and permissions in session, we don't query it every time when the user send request, so the admin's manipulation would not modify the session of the moderator. once the moderator session is not expired, the moderator still has the permissions.

so the essential requirement is how to manipulate one session by another session in the web service.

my website is based on python. Because RBAC is required, so I prefer flask more than django

django.auth module can control the access permission to each model, but what we want to control is the api/url not the model. Because rest_framework.authentication.TokenAuthentication based on django.auth, if we give up django.auth, we have to develop own token handler to defeat CSRF, but I don't want more work load.

so my question is: how to handle this situation? how to communicate or operation between different sessions in the web service, especially flask or django

if flask can resolve this problem, I'll feel better. or solution based on django is also ok.

Answer 1

If loading user from the database is slowing your application down, then I assume it is under heavy load and using a Redis server would speed things up. You can use it for:

1. Creating a data structure in Redis (for example: a hash) to store user information. Loading user from Redis is much faster. When your create/update a user in the database, you will have to modify the data in Redis, too. This way all user roles and permissions will be up-to-date.
2. Creating server side sessions with Flask-Session . All the session data is kept on the server and the user gets a key to access it. If you delete the key on the server the session is deleted and the user will have to login again.

But I think that loading user from the database is the best solution.