aiohttp-session

What it is and what it does

aiohttp_session is a middleware library that adds session support to aiohttp.web applications. It provides a dict-like interface for storing and retrieving user-specific data across HTTP requests, with the session identifier stored in an HTTP cookie named AIOHTTP_SESSION (customizable via the storage class).

The library offers three main storage backends: SimpleCookieStorage (plain JSON in cookie, for testing only), EncryptedCookieStorage (encrypted cookie storage), and RedisStorage (server-side storage in Redis with only the session key in the cookie). You register the session middleware with your aiohttp Application via the setup() function, then retrieve the session object in handlers using get_session(request). The session automatically handles expiration, TTL management, and cookie attributes.

Use it for:

• Store user login state and authentication tokens across requests in a web application.
• Track user preferences or UI state without a database.
• Maintain shopping cart or form data during multi-step workflows in async web apps.
• Use Redis as a centralized session store for load-balanced aiohttp deployments.
• Persist session data with automatic expiration and TTL management.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Provides session management for aiohttp.web applications with dict-like access to user-specific data, supporting multiple storage backends including encrypted cookies, Redis, and Memcached.

Yes. This is the standard session middleware for aiohttp.web with low install friction, active maintenance, no known vulnerabilities, and a permissive license. Install it if you are building an aiohttp web application that needs to track user state across requests. Choose your storage backend based on security and scalability needs.

Install

aiohttp-session on PyPI

pip install aiohttp-session

uv add aiohttp-session

poetry add aiohttp-session

Installing aiohttp-session

Before you install

Low friction—pure Python wheel with a single runtime dependency (aiohttp). Actively maintained as of 2024-09-25 with recent typing fixes and ongoing Python version support through 3.13.

License in practice

Apache 2 (permissive): you may use, modify, and distribute this package freely in commercial and private projects, provided you retain the license notice.

Quickstart

from aiohttp import web
from aiohttp_session import setup, get_session
from aiohttp_session.cookie_storage import EncryptedCookieStorage

async def handler(request):
    session = await get_session(request)
    session['key'] = 'value'
    return web.Response(text='OK')

app = web.Application()
setup(app, EncryptedCookieStorage(fernet_key))
app.router.add_get('/', handler)

EncryptedCookieStorage requires an external encryption library; RedisStorage requires a Redis client library. Install optional dependencies via pip install aiohttp_session[secure] or aiohttp_session[aioredis].

Verify before relying

• Whether SimpleCookieStorage is suitable for any production use cases despite documentation warnings.
• Performance characteristics and scalability limits when using Redis or Memcached backends under high concurrency.
• Exact encryption algorithm and key length requirements for EncryptedCookieStorage.

Package facts

Evidence: aiohttp_session-2.12.1-py3-none-any.whl

Tags

More WWW/HTTP packages