django，第一次在网上使用会话

客户端访问登录视图，

//user is properly set here  
user = auth.authenticate(username=email, password=password)  
auth.login(request,user)

请求登录视图的同一客户端请求另一个视图

// I expect the same user I logged in previously here. But I see anonymous user here.   
user = request.user

我不知道Web服务器如何识别两个不同的http请求（因为http是无连接的）来自同一个用户 . 但我知道 session 是使它成为可能的概念 .

我 settings.py 中有 MIDDLEWARE_CLASSES = ('django.contrib.sessions.middleware.SessionMiddleware',...)

还有什么我需要检查才能使这项工作？

-编辑

我调试了一下，
django / contrib / auth / init ：login确实是request.session [SESSION_KEY] = user.id django / contrib / auth / init ：get_user尝试在下次运行时查找request.session [SESSION_KEY]并失败 .

我需要了解request.session是什么 .
我认为请求是客户端根据http请求发送的内容 . （所以它不是持久的）

以下是我的理解，如果我错了请纠正我

当用户登录时，服务器为用户分配唯一ID并将其发送给用户 . 服务器还在某个持久的地方存储id的相关数据 . 用户为每个后续的http请求发送唯一的id . （这是cookie）Django使用给定的id查找在步骤2（或其他情况）中存储的数据 . Django将数据放入request.session并提供给查看 .

我跟着Django, request.user is always Anonymous User

我怀疑这一切都是由于我从http://www.micahcarrick.com/django-email-authentication.html复制的自定义身份验证后端

我的第一个观点 .

@csrf_exempt
def login(request):
    # import pdb                                                                                                                                                                                                                                                                
    # pdb.set_trace()                                                                                                                                                                                                                                                           

    email = request.POST['email']
    password = request.POST['password']

    user = auth.authenticate(username=email, password=password)
    # auth.logout(request)                                                                                                                                                                                                                                                      

    if user is not None and user.is_active:
        auth.login(request, user)

        profile = user.get_profile()
        user_dict = profile.to_dict()

        jsonUser = json.dumps(user_dict, ensure_ascii=False, cls=DjangoJSONEncoder)
        return HttpResponse(jsonUser)
    else:
        raise Http404

我的第二个观点 .

@csrf_exempt
def user_update(request):
    import pdb
    pdb.set_trace()

    user = request.user

=>  if not user.is_authenticated():
        raise Http404  // always ends up here

    print 'in user_update'
.......

MIDDLEWARE_CLASSES =（'django.middleware.common.CommonMiddleware'，'django.contrib.sessions.middleware.SessionMiddleware'，'django.middleware.csrf.CsrfViewMiddleware'，'django.contrib.auth.middleware.AuthenticationMiddleware'，'django .contrib.messages.middleware.MessageMiddleware'，＃取消注释简单点击劫持保护的下一行：＃'django.middleware.clickjacking.XFrameOptionsMiddleware'，）

我的后端

from django.contrib.auth.models import User, check_password

class EmailAuthBackend(object):
    """                                                                                                                                                                                                                                                                         
    Email Authentication Backend                                                                                                                                                                                                                                                

    Allows a user to sign in using an email/password pair rather than                                                                                                                                                                                                           
    a username/password pair.                                                                                                                                                                                                                                                   
    """

    supports_inactive_user = False

    def authenticate(self, username=None, password=None):
        """ Authenticate a user based on email address as the user name. """
        try:
            user = User.objects.get(email=username)
            if user.check_password(password):
                return user
        except User.DoesNotExist:
            return None

    def get_user(self, user_id):
        """ Get a User object from the user_id. """
        print 'getting an user for user_id: ', user_id
        try:
            return User.objects.get(pk=user_id)
        except User.DoesNotExist:
            return None