Flask 会话过期和 CSRF

Question

I would like to have a Flask session where the session cookie expires after 2 weeks regardless of activity.

I can get this to work without CSRF by setting:

SESSION_REFRESH_EACH_REQUEST=False

but this doesn't work when I enable CSRF.

With CSRF, the CSRF token is updated in the session for each request which causes the session expiration to be reset.

It seems that the only way to make the session expire after 2 weeks is to do it yourself (eg, store the login date in the session or user database and deleting the session when the login date is more than 2 weeks old).

This seems like a common requirement so just curious if I am missing something?

Answer 1

唯一的方法是将日期存储在某处，然后每天检查自存储日期以来是否已经 >= 2 周