Redis Cheatsheet 05 — Session Storage

session:<id> → JSON or hash { user_id, exp, csrf }

import secrets

def create_session(user_id):
    sid = secrets.token_urlsafe(32)
    redis.setex(f"session:{sid}", 86400 * 7, json.dumps({"user_id": user_id}))
    return sid

def get_session(sid):
    raw = redis.get(f"session:{sid}")
    return json.loads(raw) if raw else None

def revoke(sid):
    redis.delete(f"session:{sid}")

def create_session(user_id):
    sid = secrets.token_urlsafe(32)
    redis.hset(f"session:{sid}", mapping={
        "user_id": user_id,
        "created": time.time(),
        "ip": request.ip,
    })
    redis.expire(f"session:{sid}", 86400 * 7)
    return sid

def touch_session(sid, ttl=86400 * 7):
    redis.expire(f"session:{sid}", ttl)

def create_session(user_id):
    sid = secrets.token_urlsafe(32)
    redis.setex(f"session:{sid}", 86400 * 7, user_id)
    redis.sadd(f"user_sessions:{user_id}", sid)
    return sid

def revoke_all(user_id):
    sids = redis.smembers(f"user_sessions:{user_id}")
    if sids:
        redis.unlink(*[f"session:{s}" for s in sids], f"user_sessions:{user_id}")

response.set_cookie(
    "session",
    sid,
    httponly=True,
    secure=True,
    samesite="lax",
    max_age=86400 * 7,
)

def rotate_session(old_sid, user_id):
    new_sid = create_session(user_id)
    redis.delete(f"session:{old_sid}")
    return new_sid

def csrf_token(sid):
    token = redis.hget(f"session:{sid}", "csrf")
    if not token:
        token = secrets.token_urlsafe(32)
        redis.hset(f"session:{sid}", "csrf", token)
    return token

{user:1}:session
{user:1}:perms