I am trying to implement an invitation system in Django, compatible with django-allauth. It is similar to django-invitations, but I have some requirements that require a custom implementation.

After researching ways to do it, the only thing I have come up with so far is sending an invite link that, when accessed, adds a flag to the current session to tell django-allauth that signups are open for that session. I think doing something like this is what allauth’s docs recommend, although it does not go much into details.

However, I have read in multiple places that a GET request should not cause side effects (here’s one of many sources). Since django sessions are by default backed by a database, I think that modifying the session on a GET request (i.e. clicking the invitation link) would mean causing side-effects.

The problem is, I cannot think of another way to do it, except heavily modifying django-allauth’s views, which would be a lot more work, and possibly unsafe for an unexperienced developer like me.

So, is it the case that I should not modify the session on a GET request? If so, what other alternatives do I have?