search

mbr / flask-kvsession

A drop-in replacement for Flask's session handling using server-side sessions.
http://pythonhosted.org/Flask-KVSession/
MIT License
168 stars 53 forks source link

Dont expire sessions using TTL based on time passed since creation #47

Open papadp opened 6 years ago

papadp commented 6 years ago

Consider the following case:

An application sets flask.session.modifed = True and is using a TTL supporting store. The result is that sessions are expired based on absolute time passed since the creation of the session without any consideration of whether a session has been updated (and it's TTL also updated).