[Django] #36506: sessions.backend.cache.SessionStore.clear_expired doesn't clean

[Django]

#36506: sessions.backend.cache.SessionStore.clear_expired doesn't clean
-------------------------+--------------------------------------------
Reporter: Efe Öge | Type: Uncategorized
Status: new | Component: contrib.sessions
Version: 5.2 | Severity: Normal
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------+--------------------------------------------
Hello,

We've been using Redis as the session storage for our cache backend. To
clean up old sessions, we run the "python manage.py clearsessions"
management command. This command internally calls the clear_expired method
on the associated SessionStore. If clear_expired raises a
NotImplementedError, the command catches it and raises a CommandError,
indicating that the session backend doesn't support session cleanup. This
behavior makes sense.
https://github.com/django/django/blob/main/django/contrib/sessions/management/commands/clearsessions.py

However, in the case of the cache backend, the clear_expired method is
currently just an empty function.
https://github.com/django/django/blob/main/django/contrib/sessions/backends/cache.py#L140

I would therefore recommend either explicitly raising a
NotImplementedError here, or implementing a (potentially slow) cleanup
mechanism that actually removes expired sessions.
What are your thoughts on this? If this looks like a bug to you, I’d be
happy to help by sending a patch.
--
Ticket URL: <https://code.djangoproject.com/ticket/36506>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

[Django]

#36506: sessions.backend.cache.SessionStore.clear_expired doesn't clean

----------------------------------+--------------------------------------
Reporter: Efe Öge | Owner: (none)
Type: Bug | Status: new
Component: contrib.sessions | Version: 5.2
Severity: Normal | Resolution:

Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0

----------------------------------+--------------------------------------
Changes (by Efe Öge):

* type: Uncategorized => Bug

--
Ticket URL: <https://code.djangoproject.com/ticket/36506#comment:1>

[Django]

#36506: sessions.backend.cache.SessionStore.clear_expired doesn't clean
----------------------------------+--------------------------------------

Reporter: Efe Öge | Owner: Efe Öge
Type: Bug | Status: assigned

Component: contrib.sessions | Version: 5.2
Severity: Normal | Resolution:
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
----------------------------------+--------------------------------------
Changes (by Efe Öge):

* owner: (none) => Efe Öge
* status: new => assigned

--
Ticket URL: <https://code.djangoproject.com/ticket/36506#comment:2>

[Django]

#36506: sessions.backend.cache.SessionStore.clear_expired doesn't clean
----------------------------------+--------------------------------------
Reporter: Efe Öge | Owner: Efe Öge
Type: Bug | Status: assigned
Component: contrib.sessions | Version: 5.2
Severity: Normal | Resolution:
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
----------------------------------+--------------------------------------

Description changed by Efe Öge:

Old description:

> Hello,
>
> We've been using Redis as the session storage for our cache backend. To
> clean up old sessions, we run the "python manage.py clearsessions"
> management command. This command internally calls the clear_expired
> method on the associated SessionStore. If clear_expired raises a
> NotImplementedError, the command catches it and raises a CommandError,
> indicating that the session backend doesn't support session cleanup. This
> behavior makes sense.
> https://github.com/django/django/blob/main/django/contrib/sessions/management/commands/clearsessions.py
>
> However, in the case of the cache backend, the clear_expired method is
> currently just an empty function.
> https://github.com/django/django/blob/main/django/contrib/sessions/backends/cache.py#L140
>
> I would therefore recommend either explicitly raising a
> NotImplementedError here, or implementing a (potentially slow) cleanup
> mechanism that actually removes expired sessions.
> What are your thoughts on this? If this looks like a bug to you, I’d be
> happy to help by sending a patch.

New description:

Hello,

We've been using Redis as cache backend for session storage. To clean up

old sessions, we run the "python manage.py clearsessions" management
command. This command internally calls the clear_expired method on the
associated SessionStore. If clear_expired raises a NotImplementedError,
the command catches it and raises a CommandError, indicating that the
session backend doesn't support session cleanup. This behavior makes
sense.
https://github.com/django/django/blob/main/django/contrib/sessions/management/commands/clearsessions.py

However, in the case of the cache backend, the clear_expired method is
currently just an empty function.
https://github.com/django/django/blob/main/django/contrib/sessions/backends/cache.py#L140

I would therefore recommend either explicitly raising a
NotImplementedError here, or implementing a (potentially slow) cleanup
mechanism that actually removes expired sessions.
What are your thoughts on this? If this looks like a bug to you, I’d be
happy to help by sending a patch.

--

--
Ticket URL: <https://code.djangoproject.com/ticket/36506#comment:3>

[Django]

#36506: sessions.backend.cache.SessionStore.clear_expired doesn't clean
----------------------------------+--------------------------------------
Reporter: Efe Öge | Owner: Efe Öge

Type: Bug | Status: closed
Component: contrib.sessions | Version: 5.2
Severity: Normal | Resolution: wontfix

Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
----------------------------------+--------------------------------------

Changes (by Sarah Boyce):

* resolution: => wontfix
* status: assigned => closed

Comment:

I think future work here is likely captured by #19201

Note that it has been this way since the beginning
5fec97b9df6ea075483276de159e522a29437773 but I can see no tests were added
to `CacheSessionTests`.
I feel like updating this to a `NotImplementedError` would be a breaking
change and that's probably why it was designed this way.
--
Ticket URL: <https://code.djangoproject.com/ticket/36506#comment:4>

[Django]

#36506: sessions.backend.cache.SessionStore.clear_expired doesn't clean
----------------------------------+--------------------------------------
Reporter: Efe Öge | Owner: Efe Öge
Type: Bug | Status: closed
Component: contrib.sessions | Version: 5.2
Severity: Normal | Resolution: wontfix
Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
----------------------------------+--------------------------------------

Comment (by Efe Öge):

Thanks Sarah for your message.

I posted on the #19201 that I would like to on that.
https://code.djangoproject.com/timeline?from=2025-07-20T10%3A17%3A56-05%3A00&precision=second
--
Ticket URL: <https://code.djangoproject.com/ticket/36506#comment:5>