"""icon" sizes="16x16" href="_static/icon/favicon-16x16.png" type="image/png"> """icon" sizes="32x32" href="_static/icon/favicon-32x32.png" type="image/png"> """icon" sizes="48x48" href="_static/icon/favicon-48x48.png" type="image/png"> """icon" sizes="192x192" href="_static/icon/favicon-192x192.png" type="image/png"> """icon" sizes="512x512" href="_static/icon/favicon-512x512.png" type="image/png"> """apple-touch-icon" sizes="180x180" href="_static/icon/apple-touch-icon-180x180.png" type="image/png"> """mask-icon" href="_static/icon/safari-pinned-tab.svg" type="image/svg+xml">"""search" title="Search" href="search.html"> """prefetch" href="_static/logo/logo-light.png" as="image"> """prefetch" href="_static/logo/logo-dark.png" as="image"> """stylesheet" type="text/css" href="_static/pygments.css?v=d111a655" /> """stylesheet" type="text/css" href="_static/styles/furo.css?v=4db3a74f" /> """stylesheet" type="text/css" href="_static/styles/furo-extensions.css?v=99069b78" /> """stylesheet" type="text/css" href="_static/styles.css?v=6deb019a" /> """stylesheet" type="text/css" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0/css/fontawesome.min.css" /> """stylesheet" type="text/css" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0/css/solid.min.css" /> """stylesheet" type="text/css" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0/css/brands.min.css" />
Skip to content
Flask-Session is switching serializer to msgspec in 1.0.0. Version 0.7.0 will migrate existing sessions upon read or write.
Back to top
View this page
Edit this page

# Non-permanent sessions

Caution

Flask-session is primarily designed to be used with permanent sessions. If you want to use non-permanent sessions, you must set `SESSION_PERMANENT=False` and be aware of significant limitations.

Flask terminology regarding it’s built-in client-side session is inherited by Flask-Session:

- Permanent session: A cookie is stored in the browser and not deleted until it expires (has expiry). Also known as a persistent cookie.

- Non-permanent session: A cookie is stored in the browser and is deleted when the browser or tab is closed (no expiry). Also known as a session cookie or non-persistent cookie.

Either cookie can be removed earlier if requested by the server, for example during logout.

In the case of non-permanent server-side sessions, the server has no way to know when the browser is closed and it’s session cookie removed as a result, so it cannot confidently know when to delete the stored session data linked to that browser. This can lead to a large number of stale sessions being stored on the server.

To mitigate this somewhat, Flask-Session always sets server-side expiration time using `PERMANENT_SESSION_LIFETIME`. As such, `PERMANENT_SESSION_LIFETIME` can be set to a very short time to further mitigate this.