Flask Sessions

[tonybaloney]

Inspect Flask Session/Cookie configuration and compare with best practice

[shankarj67]

I would love to work? Any pointers on how to start with security?

[tonybaloney]

@shankarj67 before it can be coded, we have to work out what all the "bad practices" are for handling sessions in Flask.

1. What is the default configuration for sessions in Flask. Where are they stored? Are they encrypted?
2. What are the best practices for sessions?
3. What should you absolutely not do? E.g., storing passwords in sessions

This seems like a good resource to start with

https://pythonise.com/series/learning-flask/flask-session-object

Then fork this repo https://github.com/tonybaloney/pycharm-security-testing
and install the plugin into PyCharm.

Create an example Flask app with all the "bad practices".

[shankarj67]

Sure, thank you for the resources.

I will create a flask app and check everything related to sessions.