[Solved] This Flask code snippet causes session data to be lost unexpectedly:app.config['SESSION_COOKIE_HTTPONLY'] = False app.config['SECRET_KEY'] = 'topsecret'What is the likely cause? | Flask

Flask - Security Best Practices

This Flask code snippet causes session data to be lost unexpectedly:

app.config['SESSION_COOKIE_HTTPONLY'] = False
app.config['SECRET_KEY'] = 'topsecret'

What is the likely cause?

ASESSION_COOKIE_HTTPONLY=False allows JavaScript to modify cookies, causing loss

BSECRET_KEY is too short and invalid

CSESSION_COOKIE_HTTPONLY must be True to enable sessions

DMissing SESSION_COOKIE_SECURE causes session loss

Step-by-Step Solution

Solution:

Step 1: Understand HTTPONLY flag effect
Setting HTTPONLY to False allows JavaScript to access and possibly modify cookies.
Step 2: Link to session loss
Malicious or buggy scripts can alter session cookies, causing unexpected session loss.
Final Answer:
SESSION_COOKIE_HTTPONLY=False allows JavaScript to modify cookies, causing loss -> Option A
Quick Check:
HTTPONLY=False risks cookie tampering [OK]

Quick Trick: Keep HTTPONLY=True to protect session cookies from JS [OK]

Common Mistakes:

MISTAKES

Master "Security Best Practices" in Flask

9 interactive learning modes - each teaches the same concept differently

More Flask Quizzes

This Flask code snippet causes session data to be lost unexpectedly: