Quiz

1. I couldn't access the Session Secrets example, so would we be able to see something like that in class?

   I am sorry; we'll do the "userid" example together in class.

2. I'm just a bit confused by how Flask protects session cookies from being modified by users if the data is stored in the browser?

   It's a fair question. It's not that Flask prevents cookies from being tampered with; as you guessed, it can't do that. But what it can do is make the tampering evident. That's what the digital signature does.

   (I'm happy to make a brief digression into digital signatures if you'd like; they're really cool.)

   If there is evidence of tampering, Flask discards the cookie.

3. since sessions are signed but not encrypted then what type of data should we for sure avoid putting into a flask session dictionary?

   Great question, but I fear my answer will sound obvious: don't put anyone else's data into the session (privacy), and don't put security keys (e.g. app.secret_key and API keys and such (security). Don't even put their own password in there; there's no reason to ship that information back and forth.

   But their userid and stuff that every endpoint might want to know (like whether they are an admin or whether they are a premier customer) is perfectly reasonable.

4. Could you clarify when we should use cookies vs Flask's session object?

   Most of the time, we'll use sessions for logins, so you'll end the session when the browser closes that tab.

   So, cookies would be good for stuff you want to last for longer, like maybe their zip code.

   When I searched for restaurants in Seattle, I set my location to there, and Yelp still offers me restaurants in Seattle. :-)

5. No questions, thank you!

   Great!