Flask sessions, where are the cookies stored?

The Flask session cookie has the httponly flag set, making it invisible from JavaScript.

It is otherwise a normal, regular cookie so it is still stored in the browser cookie store; you should still be able to see it in your browser's developer tools.

You can set the SESSION_COOKIE_HTTPONLY option to False if you want to be able to access the cookie value from JavaScript code. From the Builtin Configuration Values section:

SESSION_COOKIE_HTTPONLY
controls if the cookie should be set with the httponly flag. Defaults to True.

The cookie contains all your session data, serialised using JSON (with tagging support for a wider range of Python types), together with a cryptographic signature that makes sure the data can't be tampered with securely.

If you disable the httponly protection, any JS code could still decode and read all your session data. Even if it can't change those values, that could still be very interesting to malicious code. Imagine a XSS bug in your site being made worse because the JS code could just read a CSRF token used to protect a web form straight from the session.

I am finding this question 3 years and 8 months later because I have an interest in the event it is modified or spoofed, to ensure my backend is able to tell the difference.

Using chrome, use F12, select Application tab, underneath Storage go to Cookies. Under cookies you'll find the webpage, select it and the right side will populate and assuming you have done something to create your session cookie, it will be there. You will notice that the value is encrypted.

Picture showing the location of session cookie

sessions are meant for server use only. That is why it is hidden and encrypted for the client. If you want to set a cookie which can be used by client/browser. You can just set a normal cookie instead of a secure cookie (like session).

You can set cookies by modifying response.

def home_page():   resp = make_response(...)   resp.set_cookie('my_cookie', 'cookie_value')   return resp

document.cookie on browser will give you mycookie=cookie_value