Flask.session persisting after close browser

Question

I want to be able to detect if a user has closed a browser since last logging into a Flask site. I have read that Flask sessions are supposed to expire on closing the browser, but the session data is stored on the server as far as I can tell and is persisting across browser sessions. How can I clear all session data when the user closes the browser?

mainapp.py:

@mainapp.route('/')
def home():
    if 'user_name' in session:
        logger.debug( 'Logged in as {0}'.format(escape(session['user_name'])))
    return render_template('home.html')

userviews.py:

@userviews.route("/login", methods=["GET", "POST"])
def login():
    form = LoginForm(request.form)
    if form.validate_on_submit():
        #get user from db
        session['user_name'] = user.user_name

setup.py:

app.secret_key = 'somethingreallysecret'

Amin Alaee · Accepted Answer · 2016-05-15T05:03:22.050

10

Because the flask session uses cookies, the data is persisted even if the user closes the window. You can track use closing the window with Flask-SocketIO.

If you want to remove a specific key from session:

from flask import session
from flask_socketio import SocketIO, emit
from flask.ext.login import current_user, logout_user

app = Flask(__name__)
app.config['SECRET_KEY'] = 'secret!'
socketio = SocketIO(app)

@socketio.on('disconnect')
def disconnect_user():
    logout_user()
    session.pop('yourkey', None)

edited May 15 '16 at 05:03

answered May 15 '16 at 04:50

Amin Alaee

1,755
16
26

I accepted as it answered the question. However I have decided the slowing of performance by using SocketIO doesn't justify it's use just just to track users closing a browser. – Don Smythe May 15 '16 at 06:19
I don't get it. You mean the SocketIO "disconnect" signal is not working? – Amin Alaee May 15 '16 at 06:20
It works fine, what I find is that the whole app slows down when I use SocketIO. – Don Smythe May 15 '16 at 06:22
1

I don't know what type of application you're developing, but keeping a web socket open has its costs. If you really need to track the connection, then this is the only way. But if you can do it with a logout or something, that'd be cheaper both for client and server. – Amin Alaee May 15 '16 at 06:37

qff · Answer 2 · 2021-04-12T12:39:30.917

2

Unless you're explicitly setting session.permanent = True the session cookie should expire when the browser closes.

Reference: Flask documentation on session.permanent

edited Apr 12 '21 at 12:39

answered Sep 14 '16 at 20:37

qff

4,965
2
32
57

The link to that page no longer exists. – Dan King Apr 10 '21 at 23:46
1

Thanks @DanKing (I've updated the link to point to the latest docs v1.1) – qff Apr 12 '21 at 12:39

score 2 · Answer 3 · answered Dec 26 '17 at 20:09

2

It seems that contrary to vanilla Flask, the sessions opened in Flask-session are permanent by default, from the documentation:

By default, all non-null sessions in Flask-Session are permanent.

So maybe try to set SESSION_PERMANENT=False?

answered Dec 26 '17 at 20:09

user9142797

21
1

Good answer. Note: the docs say that False is the default but that's not what I'm experiencing in my testing. Explicitly setting it to False works for me (your answer and my answers above). – Dan King Apr 12 '21 at 16:34

score 0 · Answer 4 · answered Apr 11 '21 at 22:59

Per the docs (https://flask.palletsprojects.com/en/1.1.x/api/#flask.session.permanent):

permanent:

"If set to True the session lives for permanent_session_lifetime seconds. The default is 31 days. If set to False (which is the default) the session will be deleted when the user closes the browser."

In the block of code where you set your session variables include this line:

session.permanent = False

E.g.

@app.route("/login", methods=["GET", "POST"])
def login() -> "html":
    if request.method == "GET":
        return render_template(
            "login.html",
        )
    else:
        # Process login form...

        # ...then set session variable
        session.permanent = False
        session["username"] = "some value"
        return render_template(
            "some_secure_page.html",
        )

Flask.session persisting after close browser

4 Answers4

Linked