feat: support server-side sessions

[dpgaspar]

SUMMARY

Supports server side sessions with multiple backends provided by flask-session.

Server-side sessions can be effectively managed and destroyed when a user logs out, ensuring that the session data is invalidated.

Adds a new config option SESSION_SERVER_SIDE bool, default to False and use Flask's default SecureCookieSession

Flask-Session supports multiple backends and config options: https://flask-session.readthedocs.io/en/latest/config.html

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

TESTING INSTRUCTIONS

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API

[michael-s-molina]

@dpgaspar Could you add more context to why do we need server side sessions? If this is a security concern, could you reach on Slack? My main concern is that server-side sessions may completely change the way we interact with the server, specifically about how we compose requests.

[dpgaspar]

@dpgaspar Could you add more context to why do we need server side sessions? If this is a security concern, could you reach on Slack? My main concern is that server-side sessions may completely change the way we interact with the server, specifically about how we compose requests.

Yes it's an optional security improvement, as is sessions will continue to behave like they currently do, don't think it will fundamentally change the way we compose requests, users will still have a session cookie but with a UUID only, the rest of the data is kept on the backend. Possible area of impact is thumbnails, I'll double check on what's required

[dpgaspar]

@dpgaspar Could you add more context to why do we need server side sessions? If this is a security concern, could you reach on Slack? My main concern is that server-side sessions may completely change the way we interact with the server, specifically about how we compose requests.

Yes it's an optional security improvement, as is sessions will continue to behave like they currently do, don't think it will fundamentally change the way we compose requests, users will still have a session cookie but with a UUID only, the rest of the data is kept on the backend. Possible area of impact is thumbnails, I'll double check on what's required

Verified this works seamlessly with thumbnails

[michael-s-molina]

LGTM. Thank you for the added context @dpgaspar and for adding doc references. They were helpful to review the impact of the change.

[dpgaspar]

LGTM. Thank you for the added context @dpgaspar and for adding doc references. They were helpful to review the impact of the change.

No problem! thank you for the review @michael-s-molina