title: webPy Sessions - Concurrent users use same session and session timeout
body: <p>I have a webPy app using sessions for user authentication. Sessions are initiated like so:</p>
  
  <pre><code>web.config.debug=False
  
  store = web.session.DiskStore('/path_to_app/sessions')
  if web.config.get('_session') is None:
      web.config.session_parameters['ignore_expiry'] = False
      web.config.session_parameters['timeout'] = 600
      web.config.session_parameters['max_age'] = 600
      web.config.session_parameters['ignore_change_ip'] = False
      web.config.session_parameters['expired_message'] = 'Session Expired... Please reload the page and login in again.'
      web.config.session_parameters['cookie_name'] = 'my_session_id'
      session_init = web.session.Session(app, store, initializer={'login':0, 'privilege':0, 'user':'none'})
      session = session_init._initializer
      web.config._session = session
  else:
      session = web.config._session
  </code></pre>
  
  <p>Here is the login class:</p>
  
  <pre><code>class Login:
      def GET(self):
          if logged() == True:
              return render.index()
          else:
              render = create_render(session['privilege'])
              return render.login()
  
  
      def POST(self):
          data= web.input()
          name = data['user']
          passwd = data['passwd']
          ident = model.get_users(m, name)
          try:
              if passwd == ident.password.strip():
                  session['login'] = 1
                  session['privilege'] = ident['privilege']
                  session['user'] = name
                  render = create_render(session['privilege'])
                  return render.index()
              else:
                  session.login = 0
                  session.privilege = 0
                  session.user = 'none'
                  render = create_render(session['privilege'])
                  return render.login()
          except:
              session['login'] = 0
              session['privilege'] = 0
              render = create_render(session['privilege'])
              return render.login()
  </code></pre>
  
  <p>and here is the logged check:</p>
  
  <pre><code>def logged():
      if session['login']==1:
          return True
      else:
          return False
  </code></pre>
  
  <p>I have two issues which I cannot figure out:</p>
  
  <ol>
  <li>When there are concurrent connections to the web server, they use the same session so if some one is logged in already, another used connecting to the site jumps straight in without authentication.</li>
  </ol>
  
  <p>UPDATE:</p>
  
  <p>A new session is in fact created in the disk store for each user but the details apart from the ID are the same - The issue still stands that a new user does not need to authenticate:</p>
  
  <pre><code>&gt;&gt;&gt; x = base64.b64decode(open("/path_to_app/sessions/71b598e8a40c62cc6b5a1bf7a380d67886e87859").read())
  &gt;&gt;&gt; pickle.loads(x)
  {'privilege': 2, 'ip': u'137.237.225.56', 'login': 1, 'user': u'admin', 'session_id': '71b598e8a40c62cc6b5a1bf7a380d67886e87859'}
  &gt;&gt;&gt; 
  &gt;&gt;&gt; y = base64.b64decode(open("/path_to_app/sessions/5a7364dc2a23ea69c61212bc496500cbb15f89bd").read()) 
  &gt;&gt;&gt; pickle.loads(y)
  {'privilege': 2, 'ip': u'137.237.225.133', 'login': 1, 'user': u'admin', 'session_id': '5a7364dc2a23ea69c61212bc496500cbb15f89bd'}
  </code></pre>
  
  <ol start="2">
  <li>When the session expires, it is not deleted. I can see the session expiring and producing the message as defined but if the user refreshes the page, they are straight back in again. Is there a way to kill the session when it expires?</li>
  </ol>
  
  <p>Thanks!</p>