Identify SESSION_ENGINE, cookie settings and the storage service. Confirm whether multiple application instances need to share session state.

1. Choose the backend that fits the deployment and keep its credentials or secret key consistent across the required processes. Avoid assuming a local in-memory cache is shared by separate workers.

2. Set the intended session lifetime and HTTPS cookie policy. Test browser behavior for the actual domain and path.

3. For a backend that stores expired sessions, schedule the supported clearsessions management command as appropriate. Use the correct virtual environment and production settings.

4. Coordinate cache eviction and service restarts with session expectations. A cache-only session store can lose sessions when entries are evicted.

5. Test sign-in, sign-out, expiry and a deployment. Check that the application does not place confidential data into a client-readable session format.

For an application using a supported database or file session backend, run the cleanup with its actual environment and settings module. The following command is an example to review and test in an isolated copy first.

.venv/bin/python manage.py clearsessions \
  --settings=config.settings.production

Replace the interpreter and settings module with the deployment's actual values. This command removes expired stored sessions; it is not a general cache flush or a request to delete every active login. Cache-only and signed-cookie backends have different expiry behavior and do not need the same stored-session purge.

In staging, keep one active test login and one expired session. After cleanup, the active login should continue to work while expired stored records are removed. Schedule the tested command through the approved scheduler and retain its completion/error evidence without logging session contents.

Confirm the same user remains authenticated across requests and across application instances as designed. Verify expired stored records are removed without deleting active sessions unexpectedly.

Frequent logouts can result from changing keys, inconsistent backends, cookie mismatches or cache eviction. Investigate which layer changed before extending session lifetime.

• Setting Django production settings and secret keys
• Configuring Django hosts and CSRF origins behind HTTPS
• Protecting shared session and cache services
• Choosing WSGI or ASGI for Django hosting

• Django sessions

• Django session cleanup