where to set 'session.permanent = True' to set session lifetime?

[ockan]

in main.py, when wrote outside the request:

app.permanent_session_lifetime = timedelta(days=5)
session.permanent = True

it got an error

RuntimeError: Working outside of request context

[GrandpaEJ]

In BustAPI (similar to Flask), session is a request-scoped context proxy. When accessed at the top/global level of main.py (outside a request context), it will raise a RuntimeError: Working outside of request context because there is no active HTTP request yet.

To configure and enable permanent sessions, set app.permanent_session_lifetime at the app level, but modify session.permanent = True within a request context:

Option A: Set inside a View Function (e.g. login route)

from datetime import timedelta
from bustapi import BustAPI, session

app = BustAPI()
app.secret_key = "some_secret_key"
app.permanent_session_lifetime = timedelta(days=5)

@app.route("/login", methods=["POST"])
def login():
    # ... authenticate user ...
    session["user_id"] = 123
    session.permanent = True  # Safe to set here inside the request context
    return {"status": "success"}

Option B: Set globally using a @app.before_request hook

from datetime import timedelta
from bustapi import BustAPI, session

app = BustAPI()
app.secret_key = "some_secret_key"
app.permanent_session_lifetime = timedelta(days=5)

@app.before_request
def make_session_permanent():
    session.permanent = True  # Runs before every request, inside context

[ockan]

session is request-scoped? session should be app-scoped, just hooked on request

[GrandpaEJ]

Well, session data contains user-specific information (like who is logged in), which is read from the request's cookies and saved to the response's cookies. If the session object itself were app-scoped (shared across the entire application/all users), everyone would share the same session, which isn't what we want.

The session object in BustAPI is a context-local proxy (similar to Flask's session) that dynamically points to the session of the active request. That's why it raises a RuntimeError if you try to access/modify it at the module level when no HTTP request is being handled.

If you want all sessions to be permanent, you can set it using a @app.before_request hook, which runs within the request context before your views:

@app.before_request
def make_session_permanent():
    session.permanent = True

[ockan]

is 'session.permanent = True' one time setting in only one handler or per-request setting?
btw, what's the relation between 'session.permanent = True' and remember=True in 'login_user(user, remember=True)'?

[GrandpaEJ]

This is an excellent question and you actually highlighted a bug in the framework!

1. "Is session.permanent = True a one-time setting or per-request?"

   • It should have been a one-time setting that persists across requests. However, as you noticed, the SessionMixin in BustAPI was not properly serializing the _permanent flag into the session cookie payload. Because of this bug, you were being forced to set it inside a @app.before_request hook.

2. "What's the relation between session.permanent and login_user(..., remember=True)?"

   • When you call login_user with remember=True, the framework should automatically flag the session as permanent, assigning it the long lifetime configured in app.permanent_session_lifetime.

I have just fixed both of these issues in the codebase:

• session.permanent is now properly serialized into the secure cookie. Setting it once will persist it across the session.
• login_user(..., remember=True) now automatically calls session.permanent = True internally.

These changes have been merged into main and released in v0.13.9.

Thank you so much for bringing this up! Your observations are incredibly valuable for hardening the framework.