Session security in Flask - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of session security in Flask?

Session security helps protect user data stored in sessions from being stolen or tampered with during a web session.

beginner

How does Flask protect session data by default?

Flask signs session cookies with a secret key to prevent tampering, ensuring the data cannot be changed by the client.

beginner

Why should you set the 'SECRET_KEY' in a Flask app?

The 'SECRET_KEY' is used to sign session cookies. Without it, Flask cannot secure session data, making it vulnerable to attacks.

intermediate

What is the role of 'secure' and 'httponly' flags in Flask session cookies?

'secure' ensures cookies are sent only over HTTPS, and 'httponly' prevents JavaScript from accessing cookies, reducing risk of theft.

intermediate

How can you prevent session fixation attacks in Flask?

Regenerate the session ID after login by clearing the session or using Flask extensions to assign a new session cookie.

What does Flask use to protect session cookies from tampering?

A No protection by default

B Encryption of cookies by default

C Storing sessions only on the server

D A secret key to sign cookies

Flask signs session cookies with a secret key to detect tampering but does not encrypt them by default.

Which flag should be set to ensure cookies are sent only over HTTPS?

A samesite

B httponly

C secure

D domain

The 'secure' flag tells the browser to send cookies only over HTTPS connections.

What is the risk if 'httponly' flag is not set on session cookies?

A Cookies can be read by JavaScript, increasing risk of theft

B Cookies will not be sent to the server

C Cookies will expire immediately

D Cookies will be encrypted

'httponly' prevents JavaScript access to cookies, protecting against cross-site scripting attacks stealing cookies.

How can you improve session security after a user logs in?

A Keep the same session ID

B Regenerate the session ID

C Disable cookies

D Store session data in local storage

Regenerating the session ID after login helps prevent session fixation attacks.

What must you set in your Flask app to enable session signing?

A SECRET_KEY

B SESSION_COOKIE_NAME

C DEBUG

D SESSION_TYPE

The 'SECRET_KEY' is required for Flask to sign session cookies and protect them from tampering.

Explain how Flask secures session data and what settings you should configure to enhance session security.

Think about cookie protection and session management best practices.

Describe common session security risks in web apps and how Flask helps mitigate them.

Consider what attackers try to do with sessions and how Flask defends.