Add OIDC back-channel logout with session indexes

2026-11-02 12:15:41 +08:00
parent ec056a15b9
commit 074e48a372
20 changed files with 1594 additions and 32 deletions
@@ -32,11 +32,25 @@ and slides on each access when the session mixin passes a `max_age`. TTLs
 larger than 30 days are automatically converted to absolute Unix timestamps,
 as required by the memcached protocol.

+## Session indexes
+
+`MemcacheSessionStore` supports `Session.add_index()`,
+`SessionStore.find_sessions()`, and `delete_by_index()`. Reverse memberships
+are stored as sets and updated with memcached CAS operations. Bucket keys use
+a SHA-256 digest of the index name and value, and stale members are pruned
+during lookups.
+
+Memcached's item-size limit (normally 1 MB) applies to each index bucket. Use
+the Redis store when one index value can have a very large number of active
+sessions.
+
 ## Serialization

 Session data is serialized with `pickle` by default, so arbitrary Python
-objects can be stored. A different serializer can be plugged in via the
-`dumps`/`loads` arguments:
+objects can be stored. The serialized value is an envelope containing the
+session dictionary and index metadata; legacy plain-dict values are still
+accepted. A different serializer can be plugged in via the `dumps`/`loads`
+arguments:

 ```python
 import json