python config_error ai_generated true

RuntimeError: The session cookie is not marked as secure. This is a security issue. Please set SESSION_COOKIE_SECURE to True in production.

ID: python/flask-session-cookie-secure-error

Also available as: JSON · Markdown · 中文
80%Fix Rate
84%Confidence
0Evidence
2024-03-30First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
3.x active — — —

Root Cause

Flask warns or errors when running in production without a secure cookie setting.

generic

中文

在生产环境中运行时，Flask 警告或报错，因为未设置安全 cookie。

Workarounds

  1. 100% success 
    Set app.config.update(SESSION_COOKIE_SECURE=True, SESSION_COOKIE_HTTPONLY=True)
  2. 90% success 
    Use environment variables to toggle secure cookies based on environment: app.config['SESSION_COOKIE_SECURE'] = os.getenv('FLASK_ENV') == 'production'

Dead Ends

Common approaches that don't work:

  1. 90% fail

    This exposes session cookies over HTTP, leading to security vulnerabilities.

  2. 70% fail

    In some Flask versions, this may become an error or cause security audit failures.