title: Somewhat confused about how auth and sessions work in Python/Django
body: <p>I'm using an existing database for my latest Django project, so unless I change my Models or the Django auth code, it's going to be rather difficult to merge the two.</p>
  
  <p>Rather than messing with the existing auth backend, I'm planning on just writing my own authentication app.</p>
  
  <p>Anyway, all of my previous authentication apps have been written in PHP, where basically i just throw everything in session variables and verify them on every page... Here's what I'm a bit confused about.  It appears that when a user is authenticated/logged in, the entire user is added to a session, but I can't figure out where or how that is occurring.</p>
  
  <p>In the default Django login function, it's assigning user to request.user ... is this being saved as a session variable somehow or is it just passed into the next view?  If it is just being passed to the next view, how are future requests authenticated without requiring further login requests?</p>
  
  <p>The default Django auth login is below..</p>
  
  <pre><code>def login(request, user):
      """
      Persist a user id and a backend in the request. This way a user doesn't
      have to reauthenticate on every request.
      """
      if user is None:
          user = request.user
      # TODO: It would be nice to support different login methods, like signed cookies.
      if SESSION_KEY in request.session:
          if request.session[SESSION_KEY] != user.id:
              # To avoid reusing another user's session, create a new, empty
              # session if the existing session corresponds to a different
              # authenticated user.
              request.session.flush()
      else:
          request.session.cycle_key()
      request.session[SESSION_KEY] = user.id
      request.session[BACKEND_SESSION_KEY] = user.backend
      if hasattr(request, 'user'):
          request.user = user
      user_logged_in.send(sender=user.__class__, request=request, user=user)
  </code></pre>
  
  <p>I also tried to follow the user_logged_in.send(), which is in django.dispatch.dispatcher.send but I'm not entirely sure what that's supposed to do either.</p>
  
  <pre><code>def send(self, sender, **named):
      """
      Send signal from sender to all connected receivers.
  
      If any receiver raises an error, the error propagates back through send,
      terminating the dispatch loop, so it is quite possible to not have all
      receivers called if a raises an error.
  
      Arguments:
  
          sender
              The sender of the signal Either a specific object or None.
  
          named
              Named arguments which will be passed to receivers.
  
      Returns a list of tuple pairs [(receiver, response), ... ].
      """
      responses = []
      if not self.receivers:
          return responses
  
      for receiver in self._live_receivers(_make_id(sender)):
          response = receiver(signal=self, sender=sender, **named)
          responses.append((receiver, response))
      return responses
  </code></pre>
  
  <p>Basically what I'm looking for is for someone to explain an efficient way to save user session data in Python that does not depend on the Django framework.  A little run-through of the Django authentication would be nice as well.</p>