Flask SECRET_KEY auto‑generation causing session loss after restart

Direct Answer

Generate one high‑entropy key (e.g., secrets.token_hex(32)), inject it via an environment variable or secrets manager so every production instance reads the identical value, and never commit it to source control. A single static key shared across all instances is both sufficient and required for cookie‑based sessions to survive restarts and scaling events.

Why Sessions Break

Flask signs its client‑side session cookies with SECRET_KEY using itsdangerous. If the key differs between processes — whether because a template generated a random value on each start or because instances received different values — the signature validation fails and the session is silently dropped. Flask itself does not auto‑generate a key when the setting is omitted; sessions simply stop working. The "auto‑generation" behavior some teams observe comes from scaffolding tools or framework wrappers, not from Flask core.

Provisioning a Stable Key

1. Generate once: python -c "import secrets; print(secrets.token_hex(32))"
2. Store securely: Place the value in AWS Secrets Manager, HashiCorp Vault, Kubernetes Secrets, or your platform’s encrypted environment‑variable store.
3. Inject at runtime: Set the SECRET_KEY environment variable in every container, pod, or VM. In your Flask config: app.config["SECRET_KEY"] = os.environ["SECRET_KEY"].

All instances behind the load balancer must read the same value so any instance can validate cookies issued by any other.

Verifying Key Stability

Log a non‑reversible fingerprint at startup on every instance:

import hashlib, os
key = os.environ["SECRET_KEY"]
fingerprint = hashlib.sha256(key.encode()).hexdigest()[:8]
app.logger.info(f"SECRET_KEY fingerprint: {fingerprint}")

Matching fingerprints across instances and before/after restarts confirm the key has not changed, without exposing the secret. Do not log the key itself or the full hash.

Detecting Unexpected Changes

Flask has no built‑in runtime warning when the key differs between processes. Implement one of:

• Startup check: compare the logged fingerprint against a stored expected hash (kept in the same secrets store) and alert on mismatch.
• Integration test: sign a test value, restart the app, and verify the signature still validates.

Key Rotation Without Mass Logout

Flask 2.1+ does not natively accept multiple keys. To rotate without invalidating all sessions, subclass the session interface or use itsdangerous’s fallback signer pattern to accept cookies signed with the previous key during a grace period. Treat a leaked key as an incident — rotate immediately and accept the resulting logouts.

Alternative: Server‑Side Sessions

If you need instant revocation or want to avoid cookie‑size limits, use Flask-Session with Redis or another server‑side store. The cookie then holds only a session ID, and validity is controlled entirely on the server.

One Diagnostic Detail

Are you currently using Flask’s default client‑side (signed cookie) sessions, or have you configured Flask-Session with a server‑side backend? The answer determines whether key stability alone solves the problem or whether session‑store connectivity must also be verified.