Session security in Flask - Step-by-Step Execution

Concept Flow - Session security

User sends request

↓

Check for session cookie

Yes↓

Validate session data

↓

Valid

↓

Allow

↓

Process request

↓

Send response with updated session cookie

This flow shows how Flask checks and validates session cookies to keep user sessions secure.

Execution Sample

Flask

from flask import Flask, session
app = Flask(__name__)
app.secret_key = 'secret'

@app.route('/')
def index():
    session['user'] = 'Alice'
    return 'Logged in as Alice'

This code sets a session key for a user and sends a response confirming login.

Execution Table

Step	Action	Session State Before	Session State After	Response Sent
1	User sends request without session cookie	{}	{}	Request proceeds, no session data
2	Server sets session['user'] = 'Alice'	{}	{'user': 'Alice'}	'Logged in as Alice' with session cookie
3	User sends next request with session cookie	{'user': 'Alice'}	{'user': 'Alice'}	Request proceeds with user session
4	Server validates session data	{'user': 'Alice'}	{'user': 'Alice'}	Request allowed
5	User logs out, session cleared	{'user': 'Alice'}	{}	Session cookie cleared, user logged out
6	User sends request with invalid session cookie	{}	{}	Request rejected or redirected

💡 Execution stops when session is invalid or user logs out, clearing session data.

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 5	Final
session	{}	{'user': 'Alice'}	{'user': 'Alice'}	{}	{}

Key Moments - 2 Insights

Why does the server reject a request with an invalid session cookie?

Because the session data does not match expected values or is tampered with, as shown in step 6 of the execution_table.

What happens to the session when the user logs out?

The session is cleared (emptied), removing user data and session cookie, as shown in step 5.

Visual Quiz - 3 Questions

Look at the execution_table, what is the session state after step 2?

A {'user': 'Alice'}

B {}

C {'user': 'Bob'}

D None

💡 Hint

Check the 'Session State After' column in row for step 2.

At which step does the session get cleared?

A Step 3

B Step 4

C Step 5

D Step 6

💡 Hint

Look for the step where 'Session State After' becomes empty {}.

If the secret_key is not set, what would happen to session security?

A Sessions remain secure

B Session cookies cannot be signed, risking tampering

C Sessions automatically clear after each request

D User data is stored in plain text on client

💡 Hint

Recall Flask uses secret_key to sign session cookies to prevent tampering.

Concept Snapshot

Session security in Flask:
- Use app.secret_key to sign session cookies
- Server checks session cookie on each request
- Invalid or missing sessions are rejected or cleared
- Use session.clear() to log out users
- Protects user data and prevents tampering

Full Transcript

In Flask, session security works by sending a signed cookie to the user that stores session data. When a user sends a request, Flask checks if the session cookie exists and if it is valid. If valid, the server allows the request and can access session data like the logged-in user. If invalid or missing, the server rejects or clears the session to protect security. Setting app.secret_key is essential to sign cookies and prevent tampering. When a user logs out, the session is cleared to remove sensitive data. This process ensures user sessions are safe and trusted.

Practice

1. What is the main purpose of setting a SECRET_KEY in a Flask application for session security?

easy

A. To store user passwords securely

B. To encrypt the entire website content

C. To sign session cookies and prevent tampering

D. To speed up the server response time

Solution

1. Step 1: Understand the role of SECRET_KEY in Flask

   The SECRET_KEY is used to cryptographically sign session cookies, ensuring they are not altered by clients.

2. Step 2: Differentiate from other security tasks

   It does not encrypt website content or store passwords; its main role is to protect session integrity.

3. Final Answer:

   To sign session cookies and prevent tampering -> Option C

4. Quick Check:

   SECRET_KEY signs sessions = A [OK]

Hint: SECRET_KEY signs session cookies to prevent tampering [OK]

Common Mistakes:

• Thinking SECRET_KEY encrypts all data
• Confusing SECRET_KEY with password storage
• Assuming SECRET_KEY improves speed

2. Which of the following is the correct way to set a secret key in a Flask app for session security?

easy

A. app.set_secret('mysecret')

B. app.secret_key = 'mysecret'

C. app.SECRET = 'mysecret'

D. app.session_key = 'mysecret'

Solution

1. Step 1: Recall Flask's secret key attribute

   Flask uses app.secret_key to set the secret key for signing sessions.

2. Step 2: Verify syntax correctness

   Options A, C, and D use incorrect attribute names or methods not defined in Flask.

3. Final Answer:

   app.secret_key = 'mysecret' -> Option B

4. Quick Check:

   Use app.secret_key to set secret key = B [OK]

Hint: Use app.secret_key to set secret key in Flask [OK]

Common Mistakes:

• Using wrong attribute names like SECRET or session_key
• Trying to call a non-existent method set_secret
• Confusing uppercase and lowercase attribute names

3. Consider this Flask code snippet:

from flask import Flask, session
app = Flask(__name__)
app.secret_key = 'safe123'

@app.route('/')
def index():
    session['user'] = 'alice'
    return session.get('user')

What will the browser display when visiting the root URL?

medium

A. Error: secret key missing

B. null

C. session

D. alice

Solution

1. Step 1: Analyze session assignment

   The code sets session['user'] = 'alice', storing 'alice' in the session.

2. Step 2: Check session retrieval and return

   The function returns session.get('user'), which retrieves 'alice' from the session.

3. Final Answer:

   alice -> Option D

4. Quick Check:

   Session stores 'alice' and returns it = A [OK]

Hint: Session stores 'user' as 'alice', so output is 'alice' [OK]

Common Mistakes:

• Assuming session returns null if not set before
• Forgetting to set secret_key causes error but here it's set
• Confusing session object with string 'session'

4. What is wrong with this Flask session security setup?

from flask import Flask, session
app = Flask(__name__)
app.secret_key = ''  # empty string

@app.route('/')
def home():
    session['logged_in'] = True
    return 'Welcome'

medium

A. Empty secret_key means sessions are not securely signed

B. Missing import of session from flask

C. Route decorator syntax is incorrect

D. Session variable name 'logged_in' is invalid

Solution

1. Step 1: Check secret_key value

   The secret_key is set to an empty string, which is insecure and disables proper signing of session cookies.

2. Step 2: Validate other code parts

   Imports and route syntax are correct; session variable names can be any string.

3. Final Answer:

   Empty secret_key means sessions are not securely signed -> Option A

4. Quick Check:

   Empty secret_key disables secure session signing = C [OK]

Hint: Never use empty string as secret_key for session security [OK]

Common Mistakes:

• Ignoring empty secret_key security risk
• Thinking session variable names must follow strict rules
• Assuming route decorator syntax is wrong here

5. You want to improve session security in your Flask app by ensuring cookies are only sent over HTTPS and not accessible by JavaScript. Which configuration should you add?

hard

A. app.config.update({'SESSION_COOKIE_SECURE': true, 'SESSION_COOKIE_HTTPONLY': true})

B. app.config.update({'SESSION_COOKIE_SECURE': false, 'SESSION_COOKIE_HTTPONLY': false})

C. app.config.update({'SESSION_COOKIE_SAMESITE': 'null'})

D. app.config.update({'SESSION_COOKIE_DOMAIN': 'localhost'})

Solution

1. Step 1: Understand cookie security flags

   SESSION_COOKIE_SECURE=true ensures cookies are sent only over HTTPS, and SESSION_COOKIE_HTTPONLY=true prevents JavaScript access.

2. Step 2: Evaluate other options

   A sets domain but not security flags, B disables security flags, C changes SameSite but not HTTPS or HttpOnly.

3. Final Answer:

   app.config.update({'SESSION_COOKIE_SECURE': true, 'SESSION_COOKIE_HTTPONLY': true}) -> Option A

4. Quick Check:

   Secure and HttpOnly cookies = D [OK]

Hint: Set SESSION_COOKIE_SECURE and SESSION_COOKIE_HTTPONLY to true [OK]

Common Mistakes:

• Setting SESSION_COOKIE_SECURE to false
• Confusing SameSite with Secure and HttpOnly flags
• Not setting HttpOnly to prevent JavaScript access