title: Flask client-side sessions
body: <p>Starting to learn Python's <a href="http://flask.pocoo.org/" rel="nofollow">Flask</a> web app framework, still on the learning curve, so please bear with me.</p>
  
  <p>I am wondering how appropriate are the client-side sessions for secure web application purposes. From what it seems, there are some serious concerns:</p>
  
  <ul>
  <li>Since all the session variables are serialized and encoded in a cookie one should be careful with how much data they store there, in order to keep the size of http data travelling back and forth in reasonable size.</li>
  <li>I'm not sure if identical key/value sets have identical serialized values, but if I'd fetch and store a cookie value in one session, can't I feed the same, albeit encrypted, value back in another session in another time, and make the server believe those are genuine session variable values? What user is allowed to do in one day doesn't mean the same thing is allowed another day. And if those session variable values have to be secure-proofed all the time, what good is from keeping them "in cache" at all? Then they serve little more purpose than letting us to use pretty GET URLs (ie, instead of ugly query string with some parameters)</li>
  </ul>
  
  <p>So, perhaps the answer I am looking for, is the limits of Flask client-side sessions, considering possible man-in-the-middle attack (for non-secure http sessions, of course) or advanced malicious user who stores the cookie values for relaying them back at later time.</p>