Stop resetting Session.created on mutation - #1219
Open
pctablet505 wants to merge 2 commits into
Open
Conversation
Session.created is documented as the timestamp of the session's first access, but __setitem__ and __delitem__ were bumping it on every change, so it actually reflected the last write instead. That behavior was added to keep idle sessions from expiring early (max_age is treated as an inactivity timeout), so simply reverting it would bring back the old expiry bug. Instead, track the last-activity time separately as last_visit and use that for the expiry check, leaving created untouched after the session is first created. Older serialized sessions without last_visit fall back to created for the expiry calculation, so existing cookies keep working. Fixes aio-libs#981
test_created_not_modified_on_mutation previously relied on real wall-clock time, so it happened to pass against the pre-fix code whenever construction and mutation landed within the same second. Mock time.time and advance it between steps so the test deterministically fails if created is ever reset on mutation. Also add the towncrier changelog fragment for aio-libs#981.
pctablet505
marked this pull request as ready for review
July 17, 2026 12:25
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What do these changes do?
Session.createdis documented as the timestamp of the session'sfirst access, but
__setitem__/__delitem__were bumping it onevery change, so in practice it reflected the last write instead.
That behavior was added in #671 to fix an idle-timeout bug (
max_ageis treated as an inactivity timeout, so an actively used session
shouldn't expire). Simply reverting #671 would bring that expiry bug
back, so instead this tracks last-activity time separately as
last_visitand uses that for the expiry check, leavingcreateduntouched after the session is first created. Sessions serialized
before this change won't have
last_visit, so the expiry check fallsback to
createdfor them, same as before.Are there changes in behavior for the user?
Session.creatednow stays fixed for the lifetime of a session,matching the documentation. The idle-timeout behavior for
max_ageis unchanged.
Related issue number
Fixes #981
Checklist