title: If Pyramid sessions are one-way hashed and not stored server-side, where is the data coming from?
body: <p>When using the <code>SignedCookieSessionFactory</code>, the documentation states that the sha512 HMAC digest algorithm is used. As a result of this, once session data is serialised, it is signed and sent to the user's client under the <code>session</code> cookie.</p>
  
  <p>There is no mention in Pyramid's documentation that sessions are also cached server-side (under this SessionFactory).</p>
  
  <p>This presents a contradiction and has also led to authentication confusion when paired with <code>SessionAuthenticationPolicy</code>. If session data cannot be retrieved from the client's <code>session</code> cookie (as it is one-way hashed), how is it that the following is possible?</p>
  
  <ol>
  <li><p>Authenticate with the application such that reading <code>Request.authenticated_userid</code> does not return None.</p></li>
  <li><p>Copy the <code>session</code> cookie to the clipboard.</p></li>
  <li><p>Logout by accessing a view whereby the headers from <code>forget(request)</code> are returned in the Response.</p></li>
  <li><p>Replace the <code>session</code> cookie with the copied value.</p></li>
  <li><p>The user is now logged back in.</p></li>
  </ol>
  
  <p>I understand that simply deleting the cookie client-side is insufficient to completely invalidate the session (without blacklisting), but this then poses the following questions:</p>
  
  <ul>
  <li><p>How is it possible to remain secure with browser-scoped sessions unless <em>every</em> session cookie the user has recently been issued is somehow remembered and blacklisted/invalidated?</p></li>
  <li><p>Is the <code>session</code> cookie actually a key/session ID that's being used to lookup a session in memory? As it's one-way signed, surely this is the only explanation?</p></li>
  <li><p>Is it possible then to invalidate sessions server-side, a little more robust than just the <code>headers=forget(request)</code> pattern?</p></li>
  </ul>
  
  <p>Ultimately, I imagine the answer is something along the lines of:
  "Maintain server-side sessions using an include such as <code>pyramid_redis_sessions</code>"</p>
  
  <p>Any explanation would be appreciated.</p>