Managing sessions

Session database. django-session.
Having a session database rather than storing in the server's memory, allows avoiding sticky sessions.
Stateless vs Sticky sessions

It's best to have sessions expire so that the data gets cleaned eventually.

When a user gets a session, Django generates a random session key, and the browser receives that key in a cookie.

Set-Cookie: sessionid=abc123...;

Typical application would put things in the session (you have to be careful about serialization?).

request.session["user_id"] = 123
request.session["is_admin"] = False
request.session["cart_id"] = "abc"
request.session["last_page"] = "/dashboard/"

This allows accessing a user from a session:

sessionid abc123
        ↓
Postgres session record
        ↓
authenticated user = 123
        ↓
request.user = User(id=123)

Anyone that acquires the session id can pretend they are that user.
HTTPS helps secure the content of the cookie. Has to be from the same website too.