"""icon" sizes="16x16" href="_static/icon/favicon-16x16.png" type="image/png"> """icon" sizes="32x32" href="_static/icon/favicon-32x32.png" type="image/png"> """icon" sizes="48x48" href="_static/icon/favicon-48x48.png" type="image/png"> """icon" sizes="192x192" href="_static/icon/favicon-192x192.png" type="image/png"> """icon" sizes="512x512" href="_static/icon/favicon-512x512.png" type="image/png"> """apple-touch-icon" sizes="180x180" href="_static/icon/apple-touch-icon-180x180.png" type="image/png"> """mask-icon" href="_static/icon/safari-pinned-tab.svg" type="image/svg+xml">"""search" title="Search" href="search.html">"""next" title="API" href="api.html">"""prev" title="Configuration" href="config.html"> """prefetch" href="_static/logo/logo-light.png" as="image"> """prefetch" href="_static/logo/logo-dark.png" as="image"> """stylesheet" type="text/css" href="_static/pygments.css?v=d111a655" /> """stylesheet" type="text/css" href="_static/styles/furo.css?v=4db3a74f" /> """stylesheet" type="text/css" href="_static/styles/furo-extensions.css?v=99069b78" /> """stylesheet" type="text/css" href="_static/styles.css?v=6deb019a" /> """stylesheet" type="text/css" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0/css/fontawesome.min.css" /> """stylesheet" type="text/css" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0/css/solid.min.css" /> """stylesheet" type="text/css" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0/css/brands.min.css" />
Skip to content
Flask-Session is switching serializer to msgspec in 1.0.0. Version 0.7.0 will migrate existing sessions upon read or write.
Back to top
View this page
Edit this page

# Security

Warning

Flask is a micro-framework and does not provide all security features out of the box. It is important to configure security settings for your application.

## Flask configuration

Please refer to documentation for Flask, OWASP, and other resources such as MDN for the latest information on best practice.

Consider the following Flask configurations in production:

Setting | Consideration
--- | ---
SESSION_COOKIE_SECURE | Set to `True` if your application is served over HTTPS.
SESSION_COOKIE_NAME | Use `__Secure-` or `__Host-` prefix according to MDN docs.
SESSION_COOKIE_SAMESITE | Use `Lax` or `Strict`

You can use a security plugin such as Flask-Talisman to set these and more.

## Storage

Take care to secure your storage and storage client connection. For example, setup SSL/TLS and storage authentication.

## Session fixation

Session fixation is an attack that permits an attacker to hijack a valid user session. The attacker can fixate a user’s session by providing them with a session identifier. The attacker can then use the session identifier to impersonate the user. As one tool among others that can mitigate session fixation, is regenerating the session identifier when a user logs in. This can be done by calling the `flask.Flask.session_interface.regenerate()` method. This method is defined in `flask_session.base.ServerSideSession`.

    @app.route('/login')
    def login():
        # your login logic ...
        app.session_interface.regenerate(session)
        # your response ...