text: # -*- coding:UTF-8 -*-
  
  import time
  from importlib import import_module
  
  from django.conf import settings
  from django.contrib.sessions.backends.base import UpdateError
  from django.core.exceptions import SuspiciousOperation
  from django.utils.cache import patch_vary_headers
  from django.utils.deprecation import MiddlewareMixin
  from django.utils.http import cookie_date
  
  
  class SessionMiddleware(MiddlewareMixin):
      def __init__(self, get_response=None):
          self.get_response = get_response
          engine = import_module(settings.SESSION_ENGINE) #得到引擎
          self.SessionStore = engine.SessionStore #得到引擎的数据存储容器
  
      def process_request(self, request):
          # 得到会话id,何时激活的？得查request何时设置的session_cookie
          session_key = request.COOKIES.get(settings.SESSION_COOKIE_NAME) 
          # 新建或获得request.session, 这里就可以使用session类字典了
          request.session = self.SessionStore(session_key) 
  
      def process_response(self, request, response):
          """
          If request.session was modified, or if the configuration is to save the
          session every time, save the changes and set a session cookie or delete
          the session cookie if the session has been emptied.
          """
          try:
              accessed = request.session.accessed
              modified = request.session.modified
              empty = request.session.is_empty()
          except AttributeError:
              pass #对于没有request.session的response直接放行
          else:
              # First check if we need to delete this cookie.
              # The session should be deleted only if the session is entirely empty
              if settings.SESSION_COOKIE_NAME in request.COOKIES and empty:
                  response.delete_cookie(
                      settings.SESSION_COOKIE_NAME,
                      path=settings.SESSION_COOKIE_PATH,
                      domain=settings.SESSION_COOKIE_DOMAIN,
                  )
              else:
                  if accessed:
                      patch_vary_headers(response, ('Cookie',))
                  
                  # 对改变的session或every_request才更新session data并更新session cookie
                  if (modified or settings.SESSION_SAVE_EVERY_REQUEST) and not empty:
                      if request.session.get_expire_at_browser_close():
                          max_age = None
                          expires = None
                      else:
                          max_age = request.session.get_expiry_age()
                          expires_time = time.time() + max_age
                          expires = cookie_date(expires_time)
                      # Save the session data and refresh the client cookie.
                      # Skip session save for 500 responses, refs #3881.
                      if response.status_code != 500:
                          try:
                              request.session.save()
                          except UpdateError:
                              raise SuspiciousOperation(
                                  "The request's session was deleted before the "
                                  "request completed. The user may have logged "
                                  "out in a concurrent request, for example."
                              )
                          response.set_cookie( # 更新会话cookie
                              settings.SESSION_COOKIE_NAME,
                              request.session.session_key, max_age=max_age,
                              expires=expires, domain=settings.SESSION_COOKIE_DOMAIN,
                              path=settings.SESSION_COOKIE_PATH,
                              secure=settings.SESSION_COOKIE_SECURE or None,
                              httponly=settings.SESSION_COOKIE_HTTPONLY or None,
                          )
          return response
  