Remember Me Functionality

By default, login state ends when the browser closes (session cookie).

“Remember me” uses a longer-lived cookie so users stay logged in.

diagram why remember me is a second, longer-lived credential mermaid

  flowchart TD
  A["login_user(user, remember=True)"] --> B["session cookie -- dies with the browser"]
  A --> C["remember cookie -- lives for REMEMBER_COOKIE_DURATION"]
  D["a later request"] --> E{"session cookie present?"}
  E -->|yes| F["logged in normally"]
  E -->|no| G{"remember cookie present and valid?"}
  G -->|yes| H["Flask-Login restores the session"]
  H --> I["current_user is set, but this is a 'remembered' login"]
  G -->|no| J["anonymous -- send to the login page"]
  I --> K["require a fresh login before changing a password or email"]

The session cookie dies when the browser closes. Remember-me is a separate cookie with its own long lifetime, and Flask-Login uses it to rebuild the session when the session cookie is gone. That is convenient and it is also a bigger window for a stolen cookie, which is why sensitive actions should re-ask for the password.

Using remember=True

python

from flask_login import login_user
 
login_user(user, remember=True)

Often the user chooses this via a checkbox.

Security tradeoffs

Remember-me is convenient but can be risky:

• if someone gains access to the device, they stay logged in

Mitigations:

• allow users to revoke sessions
• set reasonable expiration times
• require re-auth for sensitive actions

Configure duration

Flask-Login allows setting:

• REMEMBER_COOKIE_DURATION

You can set it in app config.

Best practice

For banking/high-security apps:

• avoid long remember sessions
• require multi-factor authentication (MFA)

For normal apps:

• remember-me is common and acceptable.