I am currently using the Python Flask framework's default session function to manage user login. My understanding is that, session function essentially is an encrypted cookie stored in a client's computer containing the information on which user has logged in etc.
Currently, I use
session.permanent = True
to make a user's login status permanent and use
app.permanent_session_lifetime = dt.timedelta(days=30)
to make it expire after 30 days. It works well. But my concern is, it seems to me that Flask only signs and encrypts the content of its session (i.e. the red part), but it does NOT sign and encrypt the expiration date of the cookie. My thought is that, suppose a browser is designed to ignore the "expires" section of a Set-Cookie header, it can simply send back a cookie which it knows has expired and my Flask app has no way to tell that the cookie is actually expired and let the corresponding user in rather than asking him to input the password again.
Is this a valid concern?
(Note: To be more certain, I tried to decrypted the session part manually and the content is a Python dictionary similar to the following: {'_permanent': True, 'dashboard': {'username': 'admin'}}
)
Expires
attribute is just for the browser. It can't be signed, and can't be relied upon for security. If you really want to make sure the cookie expires, you'd have to include the expiration date in the cookie content, and then check it server side when it is received.