Cookies, Sessions & Flash Messages
Flask uses cryptographically signed cookies to implement client-side sessions, ensuring that session data cannot be modified by users without a secret key.
1 Setting up Sessions
Python — session_app.py
from flask import Flask, session, redirect, url_for, flash
app = Flask(__name__)
# Secret key is required to sign session cookies
app.secret_key = "super-secret-key-change-this-in-prod"
@app.route("/login-session")
def login():
session["user"] = "Balaji"
flash("Logged in successfully!", "info")
return redirect(url_for("profile"))
@app.route("/profile")
def profile():
user = session.get("user")
if not user:
flash("You are not logged in.", "warning")
return "Please log in first."
return f"Welcome, {user}!"
2 Displaying Flashed Messages
HTML — base.html
{% with messages = get_flashed_messages(with_categories=true) %}
{% if messages %}
<div class="flashes">
{% for category, message in messages %}
<div class="alert alert-{{ category }}">{{ message }}</div>
{% endfor %}
</div>
{% endif %}
{% endwith %}
3 Code Challenge
Challenge: Add a logout route
/logout that pops the user variable from the session, flashes a success message, and redirects the user back to the home page.