PERMANENT_SESSION_LIFETIME Not Enforced with FileSystemSessionInterface about flask-session

[josephting]

The session is paired up with uuid on client side's cookie so the PERMANENT_SESSION_LIFETIME is essentially used to set the expiry of cookie.

While the session will be invalidated if the cookie is deleted or has expired, the session data remains on the server albeit never be accessed anymore.

However, I would prefer to have expired session data removed from the server but that will depend on the behavior of werkzeug.contrib.cache package instead.

I doubt the files will be removed automatically but calling prune() may be able to clear all expired session data.

[asheshv]

werkzeug.contrib.cache is likely to be removed soon, as it is deprecated.
Do you have any planning to use some other approach?

[akashsenta13]

I am also facing similar issue with PERMANENT_SESSION_LIFETIME , which not removing data from session within mentioned time frame.
I have used ServerSideSession

from flask_session.sessions import ServerSideSession

[Lxstr]

Should now be fixed from 0.6.0