My flask app set secret_key, but it can still decode without key.

[yxzlwz]

This is code from app.py:

app.config["SECRET_KEY"] = str(random.random())

And when i run this cmd:

python flask_session_cookie_manager3.py decode -c ".eJyrVipOTS5KLclLzE1VslKKKTUzN0qMKTU3TzUFkqZGFkARI2NzEwszAyUdpdLi1CK4StM0AyOgrEGacUypSapJEpBtmmyqVAsAQfAZaA.Yay2mA.Q51Q7QbVLWIssD3Pfv63Bu4czL0" 

(The session content is from web cookie)

It still work! And i can see what I've just set on my server.

Who know why? Strongly thanks.

[noraj]

Yeah it's normal. Flask cookies are protected only on integrity thanks to cryptographic signature, so users can't spoof the data embedded in the cookie. But those cookie are not protected on confidentiality so users a free to read them. No issue there.

[yxzlwz]

Seem that I asked a stupid question, maybe I mixed Flask with Django. Thanks a lot for reply!