{"record":{"id":"8406d114f2a491c2","repo":"django/django","slug":"subclasses-of-sessionbase-must-provide-a-create","errorCode":null,"errorMessage":"subclasses of SessionBase must provide a create() method","messagePattern":"subclasses of SessionBase must provide a create\\(\\) method","errorType":"exception","errorClass":"NotImplementedError","httpStatus":null,"severity":"critical","filePath":"django/contrib/sessions/backends/base.py","lineNumber":472,"sourceCode":"\n    def exists(self, session_key):\n        \"\"\"\n        Return True if the given session_key already exists.\n        \"\"\"\n        raise NotImplementedError(\n            \"subclasses of SessionBase must provide an exists() method\"\n        )\n\n    async def aexists(self, session_key):\n        return await sync_to_async(self.exists)(session_key)\n\n    def create(self):\n        \"\"\"\n        Create a new session instance. Guaranteed to create a new object with\n        a unique key and will have saved the result once (with empty data)\n        before the method returns.\n        \"\"\"\n        raise NotImplementedError(\n            \"subclasses of SessionBase must provide a create() method\"\n        )\n\n    async def acreate(self):\n        return await sync_to_async(self.create)()\n\n    def save(self, must_create=False):\n        \"\"\"\n        Save the session data. If 'must_create' is True, create a new session\n        object (or raise CreateError). Otherwise, only update an existing\n        object and don't create one (raise UpdateError if needed).\n        \"\"\"\n        raise NotImplementedError(\n            \"subclasses of SessionBase must provide a save() method\"\n        )\n\n    async def asave(self, must_create=False):\n        return await sync_to_async(self.save)(must_create)","sourceCodeStart":454,"sourceCodeEnd":490,"githubUrl":"https://github.com/django/django/blob/b5388a3a80cafcce2e34196d8e81cf5b48eb33bb/django/contrib/sessions/backends/base.py#L454-L490","documentation":"`SessionBase.create()` at base.py:466-474 raises `NotImplementedError`. It is the contract method that allocates a brand-new session record with a unique key. The base class calls it from `cycle_key()` (base.py:431-440) and from `_get_session` paths when a new session must be materialized. Concrete backends (db, cache, file, signed_cookies) override it; a custom backend that omits it will fail the first time a session is created or cycled.","triggerScenarios":"Subclassing `SessionBase`/`SessionStore` without overriding `create()`. The error fires on login (when a new session is created) or on `request.session.cycle_key()` (e.g. after privilege change).","commonSituations":"Custom session backend missing one of the four required methods; backend built for read-only use that never tested session creation; refactor that renamed `create` accidentally.","solutions":["Implement `create(self)` on your SessionStore subclass: generate a unique key, persist empty data, and set `self._session_key`.","Subclass a built-in backend and only override what you need.","Use a supported third-party backend instead of writing one from scratch."],"exampleFix":"// before\nclass SessionStore(SessionBase):\n    def load(self): ...\n// after\nclass SessionStore(SessionBase):\n    def create(self):\n        while True:\n            self._session_key = self._get_new_session_key()\n            try:\n                self.save(must_create=True)\n            except CreateError:\n                continue\n            break","handlingStrategy":"type-guard","validationCode":"class SessionStore(SessionBase):\n    def create(self):\n        while True:\n            self._session_key = self._get_new_session_key()\n            try:\n                self.save(must_create=True)\n            except CreateError:\n                continue\n            break\n# verify override:\nassert SessionStore.create is not SessionBase.create","typeGuard":"def overrides_create(cls) -> bool:\n    return getattr(cls, 'create') is not getattr(SessionBase, 'create')","tryCatchPattern":null,"preventionTips":["Subclass db/cached_db/cache/file SessionStore to inherit create().","Write an integration test that performs login (which calls create) for any custom backend.","Document the four required overrides prominently in your backend module."],"tags":["django","sessions","not-implemented","subclass","backend"],"backgroundTag":null,"analyzedSha":"b5388a3a80cafcce2e34196d8e81cf5b48eb33bb","analyzedAt":"2026-08-10T17:37:52.993Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}