没有Cookie的烧瓶登录/会话？

Question

When my user happens to have cookies disabled in their browsers, will Flask Login (Flask Session management in general) still work? Ie, does it default to an alternative, like storing information somewhere in the server-side filesystem?

Answer 1

HTTP is a stateless protocol. Your only option to track a login session is by somehow tying a request to a specific user. Unless browsers start sending some other unique identifying piece of information, cookies are your best option. Another alternative is to use Basic authentication , where the user is asked to enter a username and password in a standard dialog box (this can't be styled) and the browser will then send this data (unencrypted) along with every request.

All other techniques are far more involved, see User recognition without cookies or local storage for example. Also see How can I uniquely identify an user when cookies are not an option? for more options.

Flask-Login does support Basic Authentication; the documentation covers two different techniques for supporting this option. If you do choose to use this, make sure your site is only accessible over HTTPS encryption to prevent the username / password combination from being stolen, letting someone else log in.