[Django]-How to lookup django session for a particular user?

This answer is being posted five years after the original question, but this SO thread is one of the top Google results when searching for a solution to this problem (and it’s still something that isn’t supported out of the box with Django).

I’ve got an alternate solution for the use case where you’re only concerned with logged in user sessions, which uses an additional UserSession model to map users to their sessions, something like this:

from django.conf import settings
from django.db import models
from django.contrib.sessions.models import Session

class UserSession(models.Model):
    user = models.ForeignKey(settings.AUTH_USER_MODEL)
    session = models.ForeignKey(Session)  

Then you can simply save a new UserSession instance any time a user logs in:

from django.contrib.auth.signals import user_logged_in

def user_logged_in_handler(sender, request, user, **kwargs):
    UserSession.objects.get_or_create(user = user, session_id = request.session.session_key)

user_logged_in.connect(user_logged_in_handler)

And finally when you’d like to list (and potentially clear) the sessions for a particular user:

from .models import UserSession

def delete_user_sessions(user):
    user_sessions = UserSession.objects.filter(user = user)
    for user_session in user_sessions:
        user_session.session.delete()

That’s the nuts and bolts of it, if you’d like more detail I have a blog post covering it.

I found this code snippet

from django.contrib.sessions.models import Session
from django.contrib.auth.models import User

session_key = '8cae76c505f15432b48c8292a7dd0e54'

session = Session.objects.get(session_key=session_key)
uid = session.get_decoded().get('_auth_user_id')
user = User.objects.get(pk=uid)

print user.username, user.get_full_name(), user.email

here
http://scottbarnham.com/blog/2008/12/04/get-user-from-session-key-in-django/

Have not verified it yet, but looks pretty straight forward.

This is somewhat tricky to do, because not every session is necessarily associated with an authenticated user; Django’s session framework supports anonymous sessions as well, and anyone who visits your site will have a session, regardless of whether they’re logged in.

This is made trickier still by the fact that the session object itself is serialized — since Django has no way of knowing which data exactly you want to store, it simply serializes the dictionary of session data into a string (using Python’s standard “pickle” module) and stuffs that into your database.

If you have the session key (which will be sent by the user’s browser as the cookie value “sessionid”), the easiest way to get at the data is simply to query the Session table for the session with that key, which returns a Session object. You can then call that object’s “get_decoded()” method to get the dictionary of session data. If you’re not using Django, you can look at the source code (django/contrib/sessions/models.py) to see how the session data is deserialized.

If you have the user id, however, you’ll need to loop through all of the Session objects, deserializing each one and looking for one which has a key named “_auth_user_id”, and for which the value of that key is the user id.

Peter Rowell, thanks for your response. It was a tremendous help. This is what I did to get it working. Only had to change one file in djang.contrib.sessions.

In django/contrib/sessions/models.py, add the user_id to the table (add to DB table manually or drop table and run manage.py syncdb).

class Session(models.Model):

    ...

    user_id = models.IntegerField(_('user_id'), null=True)

    ...

    def save(self, *args, **kwargs):
        user_id = self.get_decoded().get('_auth_user_id')
        if ( user_id != None ):
            self.user_id = user_id

        # Call the "real" save() method.
        super(Session, self).save(*args, **kwargs)

Now in your view where you do login (if you use django’s base login, you will have to override it)

# On login, destroy all prev sessions
        # This disallows multiple logins from different browsers
        dbSessions = Session.objects.filter( user_id = request.user.id )
        for index, dbSession in enumerate( dbSessions ):
            if ( dbSession.session_key != request.session.session_key ):
                dbSession.delete()

This worked for me.

I ran across this problem when I wanted to kick out a spammer. It seems setting their account to “inactive” isn’t enough, because they can still come in on their previous session. So – how to delete a session for a specific user, or how to deliberately expire a session for a specific user?

The answer is to user the last_login field to track down the time at which the session was disabled, which tells you that the expire_date is two weeks later, which lets you perform a useful filter on the sessions table:

from django.contrib.sessions.models import Session
from django.contrib.auth.models import User
from datetime import datetime
from dateutil.relativedelta import relativedelta

baduser = User.objects.get(username="whoever")     
two_weeks = relativedelta(weeks=2)
two_hours = relativedelta(hours=2)
expiry = baduser.last_login + two_weeks
sessions = Session.objects.filter(
    expire_date__gt=expiry - two_hours,
    expire_date__lt=expiry + two_hours
) 
print sessions.count() # hopefully a manageable number

for s in sessions:
    if s.get_decoded().get('_auth_user_id') == baduser.id:
        print(s)
        s.delete()