Flask interview question · Most asked
How do Flask sessions work and what are their security implications?
Summary
By default Flask stores session data client-side in a cookie signed with SECRET_KEY (via ItsDangerous). Users can read the contents (it's only signed, not encrypted) but cannot modify them without invalidating the signature.
Longer Answer
Never put secrets in the default session. Keep it small (cookie size limits). For server-side sessions (revocation, larger data) use Flask-Session with Redis. Configure SESSION_COOKIE_SECURE, SESSION_COOKIE_HTTPONLY, SESSION_COOKIE_SAMESITE and PERMANENT_SESSION_LIFETIME. Rotating SECRET_KEY logs everyone out (SECRET_KEY_FALLBACKS in Flask 3.1 eases rotation).
Key Points
- Signed, not encrypted, cookie by default
- Don't store secrets in it
- Flask-Session for server-side storage
- Secure cookie flags
SECRET_KEY_FALLBACKSfor key rotation (3.1)
Explanation
Common mistakes
- Using a weak or committed
SECRET_KEY - Storing user roles in the session without server-side verification
More most-asked Flask questions
- How do you access request data and build responses in Flask?
- How do you use SQLAlchemy with Flask (Flask-SQLAlchemy 3.x)?
- What is the application factory pattern in Flask and why use it?
- What is Flask and what does 'microframework' mean?
- Explain Flask's application context and request context.
- What are Blueprints in Flask?
- How does routing work in Flask, including variable rules and HTTP methods?
- How do you implement user authentication in Flask?