Comments (4)
Can you please confirm what settings you have for SESSION_REFRESH_EACH_REQUEST and SESSION_PERMANENT?
from flask-session.
PERMANENT_SESSION_LIFETIME = timedelta(seconds=3600)
SESSION_TYPE = "filesystem"
SESSION_PERMANENT = False
SESSION_USE_SIGNER = True
SESSION_REFRESH_EACH_REQUEST not set.
I've tested SESSION_REFRESH_EACH_REQUEST=True.
it make every response make SetCookie and refresh the server side expiration.
from flask-session.
Ok so the non permanent session is what's causing it. should_set_cookie which comes from flask) evaluates
session.modified or (
session.permanent and app.config["SESSION_REFRESH_EACH_REQUEST"]
)
This logic makes sense to reduce unneeded setting of client side cookies that have no expire and therefore no need to update every request.
I guess you could make the case that this should be different for updating the stored session but ultimately non permanent sessions don't really fit that well in server side sessions. In the upcoming releases I've added documentation that explains that we use the PERMANENT_SESSION_LIFETIME to set the expiry in storage even for non permanent sessions. (edit: This is to prevent lots of un-expirable sessions in storage)
If you are using a non permanent session effectively normally you are saying you don't care about expiration but just want to only have a session while the tab is open. However, perhaps there is a case where server side sessions could actually provide something more restrictive: a session that only exists in an open tab AND expires.
In that case we would need to modify the logic either in the save_session or overwrite the should_set_cookie.
May I ask your use for non permanent session and if it is indeed this edge case I'm suggesting
from flask-session.
If it is, it may be an option to add a method for should_set_storage which would limit the storage aspects separately, given the should_set_cookie still effectively prevents unneeded cookie sets. Would the below function make sense?
def should_set_storage(self, app: Flask, session: SessionMixin) -> bool:
"""Used by session backends to determine if session in storage
should be set for this session cookie for this response. If the session
has been modified, the session is set to storage. If
the ``SESSION_REFRESH_EACH_REQUEST`` config is true, the session is
always set to storage. In practice, this means refreshing the expiry.
.. versionadded:: 0.7.0
"""
return session.modified or app.config["SESSION_REFRESH_EACH_REQUEST"]
If this is false, we can be confident that should_set_cookie is also false. Therefore, we could check this first and return if false.
from flask-session.
Related Issues (20)
- Changelog for Flask-session 0.6.0 missing HOT 4
- DynamoDB backend implementation. HOT 4
- A 'SQLAlchemy' instance has already been registered on this Flask app HOT 9
- Signing server-side session: is it needed? HOT 1
- `SqlAlchemySessionInterface` docstring and constructor arguments in 0.7.0rc2 HOT 1
- Revoking sessions HOT 2
- Version 0.7.0 is a breaking change HOT 4
- TypeError: Encoding objects of type LazyString is unsupported HOT 8
- Allow to instansiate Session with custom session interface HOT 12
- DynamoDB retrieve session does not check for expiration time
- Possible regression: Table 'sessions' is already defined
- can make `SESSION_SERIALIZATION_FORMAT` = 'json' work HOT 1
- Error from version 0.6.0 to 0.8.0 on loading HOT 1
- Deprecation Warnings
- SQLAlchemy backend intermittently errors on concurrent requests HOT 2
- Fix datetime.utcnow() deprecations in SQLAlchemy backend
- Allow static resources to bypass opening sessions HOT 5
- >0.6.0 breaks session['last_active'] HOT 2
- Incorrect trailing comma in CacheLib usage example
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from flask-session.