Keep user signed in using mod_wsgi

Question

I'm developing a web app using my own framework that I created using mod_wsgi.

I want to avoid using dependencies such as Django or Flask, just to have a short script, It actually won't be doing much.

I have managed to authenticate user using LDAP, from a login page, the problem is that I don't want the user to authenticate every time a action requires authorization, but I don't know how to keep user logged in.

Should I use the cookies? If so, what would be the best method to keep identification in cookies? What are my options?

Answer 1

The best (read: easiest) way to go about this is with session variables. That said, in lieu of session variable functionality you would get with a framework, you can implement your own basic system.

1) Generate a random Session id

2) send a cookie to browser

3) Json or pickle encode your variables

4a) save encoded string to key-value storage system like redis or memcached with session if as the key, or

4b) save it to a file on the server preferably in /tmp/