Why do some Flask session values disappear from the session after closing the browser window, but then reappear later without me adding them?

Turns out the problem was a multiple domain cookie thing. I am running the site locally at 127.0.0.1:5000 but sometimes the site was accessed at localhost:5000 - so each of those domains had a separate cookie. Which explains why the data was disappearing and then reappearing. It was just associated with different domains.

Below is just extra detail

This came about because Facebook doesn't like IP addresses for domain names. So when developing locally, I was using 127.0.0.1:5000 but the Facebook callback url was localhost:5000. Which works fine because Flask picks up requests at both urls and treats them the same - all routes work as expected. Except for the session cookies which get associated with the different urls.

Flask sessions will be deleted once you close the browser IF you have not set the session.permanent = True. That is how flask sessions are defined and is mentioned in the docs.

If you do however set the session as permanent, then default is 31 days when the session will persist. You can change that default as well by session.permanent_session_lifetime. This means that the session will persist even if you close the browser unless of course, you delete the cookie itself manually.

In your case, I am not sure how you are using AJAX calls but in general, the above should hold true about default flask sessions.