Only cycle session id if account changed

Avoids session id changing on every request

python/nav/web/auth/utils.py

@@ -31,14 +31,15 @@
 ACCOUNT_ID_VAR = 'account_id'
 
 
-def set_account(request, account):
+def set_account(request, account, cycle_session_id=True):
     """Updates request with new account.
     Cycles the session ID to avoid session fixation.
     """
     request.session[ACCOUNT_ID_VAR] = account.id
     request.account = account
     _logger.debug('Set active account to "%s"', account.login)
-    request.session.cycle_key()
+    if cycle_session_id:
+        request.session.cycle_key()
     request.session.save()
 
 
@@ -54,7 +55,10 @@ def ensure_account(request):
         # Assumes nobody has locked it..
         account = Account.objects.get(id=Account.DEFAULT_ACCOUNT)
 
-    set_account(request, account)
+    account_has_changed = account.id != session.get(ACCOUNT_ID_VAR)
+
+    # Only cycle session_id if account has changed
+    set_account(request, account, cycle_session_id=account_has_changed)
 
 
 def authorization_not_required(fullpath):