Skip to content
Hallway
0:00 / 0:00

#flask#sessioncookies#base64

How to Decode Flask User Sessions

Miguel Grinberg

15K subscribers • 2 videos on Hallway

YouTube
  • Recommended by 1 person: 1 on Stack Overflow and its sister sites.
  • Presented by Miguel Grinberg
  • May be out of date. Uploaded 10 years ago, in an area where tools change fast.

Intermediate. Assumes working knowledge.

29K views10 years ago1 recommendation

Web developmentSecurityPythonWeb and application security

Miguel Grinberg explains how Flask session cookies are structured, how to decode them, and how cryptographic signatures prevent tampering.

This video will show you how easy it is to view what is stored in a Flask user session cookie. For additional information, see this related blog article: blog.miguelgrinberg.com/post/how-secure-is-the-flask-user-se… Support my work on Patreon: patreon.com/miguelgrinberg

Why it's here

1 person recommends this

What people say. Linked to explain that Flask session data is readable by users but protected from tampering by a cryptographic signature.

Moments people linked to

stasiekzon Stack Overflow • Recommends

On “Can Flask session data be altered by users (threat actors)?”

Although Flask session contents can be seen by anyone who knows how to decode base64, user can't simply modify its contents by setting desired values and puting them back base64-encoded in session because of integrity signature you can hear about at link to this video. The signature itself is generated based on session contents and app secret which is visible only on server side. So the user won't be able to tamper with session's contents successfully because he doesn't know the key set in SECRET_KEY in application settings. So answering your question: you can store such admin flag in session and it will not be a threat to security provided your secret key is random enough Flask session doc and not…
7View the answer