SSL-only session interface for Flask. Sets session cookie only on SSL connection to prevent session hijacking. Sessions will not work on unsecured connections. Need to implement additional secondary session for insecure connection if flashes or something is needed.

Flask SSL-only Session Interface

# Usage:
app = Flask()
app.session_interface = SecureCookieSSLOnlySessionInterface()


from flask.sessions import SecureCookieSessionInterface
from flask import request

class SecureCookieSSLOnlySessionInterface(SecureCookieSessionInterface):
    """The SSL cookie session interface. Sets cookie only on SSL connections.
    """

    def request_is_secure(self, request):
        criteria = [
            request.is_secure,
            request.headers.get('X-Forwarded-Proto', 'http') == 'https'
        ]

        return any(criteria)

    def save_session(self, app, session, response):
        # Don't save session if request is not secure
        if not self.request_is_secure(request):
            return

        return super(SecureCookieSSLOnlySessionInterface, self).save_session(app, session, response)