---
title: "Tornado’s secure cookie support in Flask"
description: "<p><a href="https://i1.wp.com/eran.sandler.co.il/wp-content/uploads/2015/12/tornado-cookie-flask.png" rel="attachment wp-att-432"><img class="alignright size-full wp-image-432" src="https://i1.wp.com/eran.sandler.co.il/wp-content/uploads/2015/12/tornado-cookie-flask.png?fit=140%2C147" alt="tornado-cookie-flask" data-recalc-dims="1" /></a>I’ve recently had the chance to write a new project on AppEngine.</p>
<p>It’s been a long time since I tried I was too lazy (as always) to setup servers just for that.</p>
<p>I’ve decided to use Python but just to be sure I won’t be vendor locked into various AppEngine services I’ve decided to use:</p>
<ul>
<li>Flask (instead of webapp2)</li>
<li>Cloud SQL (instead of DataStore)</li>
</ul>
<p>This will ensure that I can break out of AppEngine easily with minimal code changes.</p>"
doc_version: "1"
last_updated: "2017-06-02"
date: 2015-12-27
tags: [appengine, cookies, flask, Google AppEngine, Python, secure cookie, secure cookies, tornado]
canonical: "https://eran.sandler.co.il/2015/12/27/tornados-secure-cookie-support-in-flask/"
---

## Sitemap

- [Home](https://eran.sandler.co.il/)

<a href="https://i1.wp.com/eran.sandler.co.il/wp-content/uploads/2015/12/tornado-cookie-flask.png" rel="attachment wp-att-432"><img class="alignright size-full wp-image-432" src="https://i1.wp.com/eran.sandler.co.il/wp-content/uploads/2015/12/tornado-cookie-flask.png?fit=140%2C147" alt="tornado-cookie-flask" data-recalc-dims="1" /></a>I&#8217;ve recently had the chance to write a new project on AppEngine.

It&#8217;s been a long time since I tried I was too lazy (as always) to setup servers just for that.

I&#8217;ve decided to use Python but just to be sure I won&#8217;t be vendor locked into various AppEngine services I&#8217;ve decided to use:

  * Flask (instead of webapp2)
  * Cloud SQL (instead of DataStore)

This will ensure that I can break out of AppEngine easily with minimal code changes.

This was the first major Flask project I&#8217;ve written and I found its current cookie support a bit lacking compared to Tornado&#8217;s secure cookies (I won&#8217;t go into the debate of why it should be kept like that and why I&#8217;m not using a session cookie that points to the real session data somewhere else).

I&#8217;ve decided to create a small module to add Tornado&#8217;s secure cookie support into Flask.

It&#8217;s basically a modified version of the current Tornado Secure Cookie code and its quite easy to use in Flask as well.

[Grab it and share your comments and opinions][1]. It&#8217;s also available on PyPI under the name &#8220;[flask-secure-cookie][2]&#8220;.

 [1]: https://github.com/erans/flask-secure-cookie
 [2]: https://pypi.python.org/pypi/flask-secure-cookie