SECRET_KEY et cookies signés

By default Flask stores the whole session inside a cookie in the user's browser, not on your server. That has big implications.

If data lives in the browser, a user could edit it. Flask stops that by signing the cookie so changes are detectable.

Signing needs a secret. The SECRET_KEY is the private value Flask uses to stamp and verify every session cookie. 🔑

Touch the session without a SECRET_KEY set and Flask raises a RuntimeError. It refuses to sign with nothing.

Important: a default session cookie is signed, not encrypted. Anyone can read it, so never store true secrets inside.

On each request Flask recomputes the signature from the cookie and the key. A mismatch means tampering, so the session is rejected.

A strong SECRET_KEY should be long and unpredictable. Generate one with the secrets module rather than typing a word.

Keep the SECRET_KEY out of source control. Load it from an environment variable so each deploy has its own value.

Change the SECRET_KEY and every existing session signature stops matching. All users get logged out at once.

Run several app instances behind a load balancer? They must share one SECRET_KEY or each will reject the others' cookies.

Need bigger or hidden session data? Extensions like Flask-Session keep it on the server and store only an id in the cookie.

Think about what the default Flask session cookie actually protects.

You saw that SECRET_KEY signs session cookies to catch tampering. Make it long, load it from the environment, and never commit it. 🔐