Session security in Flask - Step-by-Step Execution

Concept Flow - Session security

User sends request

↓

Check for session cookie

Yes↓

Validate session data

↓

Valid

↓

Allow

↓

Process request

↓

Send response with updated session cookie

This flow shows how Flask checks and validates session cookies to keep user sessions secure.

Execution Sample

Flask

from flask import Flask, session
app = Flask(__name__)
app.secret_key = 'secret'

@app.route('/')
def index():
    session['user'] = 'Alice'
    return 'Logged in as Alice'

This code sets a session key for a user and sends a response confirming login.

Execution Table

Step	Action	Session State Before	Session State After	Response Sent
1	User sends request without session cookie	{}	{}	Request proceeds, no session data
2	Server sets session['user'] = 'Alice'	{}	{'user': 'Alice'}	'Logged in as Alice' with session cookie
3	User sends next request with session cookie	{'user': 'Alice'}	{'user': 'Alice'}	Request proceeds with user session
4	Server validates session data	{'user': 'Alice'}	{'user': 'Alice'}	Request allowed
5	User logs out, session cleared	{'user': 'Alice'}	{}	Session cookie cleared, user logged out
6	User sends request with invalid session cookie	{}	{}	Request rejected or redirected

💡 Execution stops when session is invalid or user logs out, clearing session data.

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 5	Final
session	{}	{'user': 'Alice'}	{'user': 'Alice'}	{}	{}

Key Moments - 2 Insights

Why does the server reject a request with an invalid session cookie?

Because the session data does not match expected values or is tampered with, as shown in step 6 of the execution_table.

What happens to the session when the user logs out?

The session is cleared (emptied), removing user data and session cookie, as shown in step 5.

Visual Quiz - 3 Questions

Look at the execution_table, what is the session state after step 2?

A {'user': 'Alice'}

B {}

C {'user': 'Bob'}

D None

💡 Hint

Check the 'Session State After' column in row for step 2.

At which step does the session get cleared?

A Step 3

B Step 4

C Step 5

D Step 6

💡 Hint

Look for the step where 'Session State After' becomes empty {}.

If the secret_key is not set, what would happen to session security?

A Sessions remain secure

B Session cookies cannot be signed, risking tampering

C Sessions automatically clear after each request

D User data is stored in plain text on client

💡 Hint

Recall Flask uses secret_key to sign session cookies to prevent tampering.

Concept Snapshot

Session security in Flask:
- Use app.secret_key to sign session cookies
- Server checks session cookie on each request
- Invalid or missing sessions are rejected or cleared
- Use session.clear() to log out users
- Protects user data and prevents tampering

Full Transcript

In Flask, session security works by sending a signed cookie to the user that stores session data. When a user sends a request, Flask checks if the session cookie exists and if it is valid. If valid, the server allows the request and can access session data like the logged-in user. If invalid or missing, the server rejects or clears the session to protect security. Setting app.secret_key is essential to sign cookies and prevent tampering. When a user logs out, the session is cleared to remove sensitive data. This process ensures user sessions are safe and trusted.