mitsuhiko/flask — pull request #929 by davislx (2013-12-14 02:08:07+00:00)
Title: Added SESSION_COOKIE_PERMANENT configuration to control permanent session

Pull request summary
----------------------
Added `SESSION_COOKIE_PERMANENT` configuration to control whether the signed cookie based flask session will be initialized to permanent or not.
Corresponding documentation and tests

Testing done
---------------------
New unit test for positive and negative cases, as well as making sure the old tests didn't break
```
$ python run-tests.py
........................................................................................................................................................................................................................................
----------------------------------------------------------------------
Ran 232 tests in 1.738s

OK
```

Use case
-------------------
As a flask application developer (user of the framework), I wanted to be able to set the browser session timeout.

Steps to reproduce
--------------------
```
from flask import Flask
from datetime import timedelta
app = Flask(__name__)
app.config['PERMANENT_SESSION_LIFETIME'] = timedelta(days=1)
```

Expectation
---------------------
The signed cookie based session times out after a day

Reality
--------------------
Session is transient unless `session.permanent` was set to `True`.
The documentation on the configuration option `PERMANENT_SESSION_LIFETIME` doesn't mention it only works after `session.permanent` was set.
Once figured out this, the natural thing I did was
```
from flask import Flask, session
from datetime import timedelta
app = Flask(__name__)
app.config['PERMANENT_SESSION_LIFETIME'] = timedelta(days=1)
session.permanent = True
```
It is a little bit frustrating to find out that we need a request context to access session, so that we either need to put it into a view_func, or a @before_request

Alternatives
-------------------
1. We can assume *having `PERMANENT_SESSION_LIFETIME` configured* indicates that a permanent session is expected
2. Add another configuration key to control how the session object should be initialized.

Evaluation and Fix
-------------------
For alternative 1: In python, explicit is always better than implicit. Plus, since we already have `PERMANENT_SESSION_LIFETIME` default to 30 days, that means if we go this route, the default session behavior will change from transient to permanent. This breaks backward compatibility
Alternative 2 is the way to go