title: How to store objects in back-end sessions in Django just like Django stores User
body: <p>I'm creating a webapp in Django. I already run through Django tutorials from <a href="https://docs.djangoproject.com/en/dev/intro/" rel="noreferrer">https://docs.djangoproject.com/en/dev/intro/</a> and part of documentation</p>
  
  <p>I have a question how to store additional data between requests on the server-side.
  Django does it really cool with users as follows:</p>
  
  <p>in views.py:</p>
  
  <pre><code>def login_user(request):
      if request.POST:
          username = request.POST.get('username')
          password = request.POST.get('password')
  
          user = authenticate(username=username, password=password)
          if user is not None:
              if user.is_active:
                  login(request, user)
                  return HttpResponseRedirect(settings.LOGIN_REDIRECT_URL)
  </code></pre>
  
  <p>now in another function you can use the information stored in back-end which is associated via csrf token like this:</p>
  
  <p>in views.py</p>
  
  <pre><code>@login_required
  def myappformmethod(request):
      user = request.user
      msg = 'hello '+user.username
  </code></pre>
  
  <p>the generated html file does not contain any direct information about the user which is logged, but it keeps the csrf token as a form field:</p>
  
  <pre><code>&lt;form name="myform" action="/myapp/myappformmethod" method="post" onsubmit="prepare()"&gt;
  &lt;div style='display:none'&gt;&lt;input type='hidden' name='csrfmiddlewaretoken' value='NwKW2lFWSkkNEasdd3ExHe1l5ltzQi' /&gt;&lt;/div&gt;
  </code></pre>
  
  <p>I would like to store some session-related data (e.g. favourite color) that will not be visible in html, but will be stored on server side and will be available using something like:</p>
  
  <pre><code>if request.favourite_color:
      color = request.favourite_color
  </code></pre>
  
  <p>and not using</p>
  
  <pre><code>if request.POST.get('favourite_color'):
      request.POST.get('favourite_color')
  </code></pre>
  
  <p>which is vulnerable to manual form element manipulation (if passed using form fields [type:hidden does not help, since you can edit them as well])</p>
  
  <p>The aproriate approach would be adding field to request and producing something like "login" method mentioned earlier ... but how to do it?</p>
  
  <p>Thanks!</p>