Background:
As a performance improvement, inveniosoftware/invenio-accounts#292 introduces new logic to avoid storing session for anonymous users in Redis (or the configured backend).
Problem:
However, this creates a side-effect; in each request (get the page, JS, CSS etc..) the anonymous user gets a new session, see:
First request gets a session (already different to the existing one as the page was reloaded)
Second request sends the previously received session but gets a new one in responses
Previous to the last request sets a new session
The last request now sends as session cookie the one set by the previous request and yet another session is created
This produces:
If one omits the new factory to avoid storing sessions for anonymous users everything works as expected.
Guesses
- We suspect that this is caused due to the final request including the latest received session while the form was loaded using a (Session bound CSRF?) that was generated with a different session.
- Another guess would be that when it tries to match the CSRF, it gets the form/csrf/session from the request i.e the form submitted and then it tries to find this in the store provider(Redis, in memory)...but as long as we don't store the anonymous sessions that would return None and the comparison would fail..
Background:
As a performance improvement, inveniosoftware/invenio-accounts#292 introduces new logic to avoid storing session for anonymous users in Redis (or the configured backend).
Problem:
However, this creates a side-effect; in each request (get the page, JS, CSS etc..) the anonymous user gets a new session, see:
First request gets a session (already different to the existing one as the page was reloaded)
Second request sends the previously received session but gets a new one in responses
Previous to the last request sets a new session
The last request now sends as session cookie the one set by the previous request and yet another session is created
This produces:
If one omits the new factory to avoid storing sessions for anonymous users everything works as expected.
Guesses