Flask session lifetime

The browser will never send secure cookies with requests that are not encrypted . With Flask, you can control the secure flag on the session cookie with the SESSION_COOKIE_SECURE configuration setting. By default, it is set to False , which makes the session cookie available to both HTTP and HTTPS connections.

Flask doesn’t have a ‘encrypt cookie’ setting , because it is not deemed necessary when you can secure the cookie in other ways.

the login process seems secure . But you didn’t check the potential existing user in the signup form, or existing email address. Unless this is managed by the underlying User schema. And you should require a minimal password complexity.

the login process seems secure . But you didn’t check the potential existing user in the signup form, or existing email address. Unless this is managed by the underlying User schema. And you should require a minimal password complexity.

Flask-Security allows you to quickly add common security mechanisms to your Flask application . They include: Session based authentication. Role and Permission management.