From 7eb64b4b9aa8bb13ab9315f99a2430e59a6e3c23 Mon Sep 17 00:00:00 2001 From: Gail Terman Date: Mon, 10 Aug 2020 14:28:49 -0400 Subject: [PATCH] [CASB-122624] add logging on corrupted session This is to help aid during production outages related to a corrupted session. We are using print logging because there is no logger available here, so the logs will appear as lines in whatever log the starting process outputs (typically the apache2 error log in `/var/log/apache2/error.log` for ui portal). --- django/contrib/sessions/backends/el_db.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/django/contrib/sessions/backends/el_db.py b/django/contrib/sessions/backends/el_db.py index e652bde8f21c..837810560c0d 100644 --- a/django/contrib/sessions/backends/el_db.py +++ b/django/contrib/sessions/backends/el_db.py @@ -45,6 +45,8 @@ def decode(self, session_data): def _decode_with_single_key(self, hash_val, serialized): expected_hash = self._hash(serialized) if not constant_time_compare(hash_val.decode(), expected_hash): + # logging using print because there is no logger here + print("Session data is corrupted!") raise SuspiciousOperation("Session data corrupted") return self.serializer().loads(serialized) @@ -57,4 +59,6 @@ def _decode_with_multiple_keys(self, hash_val, serialized): # If here, that means session got decoded return self.serializer().loads(serialized) # If here, then we've exhausted all the keys, raise Exception + # logging using print because there is no logger here + print("Session data is corrupted!") raise SuspiciousOperation("Session data corrupted")