Flask中Session的实现，关于session和cookie的原理读者可查阅其他资料，我的理解如下：

服务器会为每个新到来的连接创建一个sessionID，以此识别各个连接，另外服务器可以根据sessionID来找到保存在服务器端的这个连接之前保存的数据。这个功能有两个好处：将数据保存在服务器端更安全，相比客户端而言更不容易被攻击；二是由于http协议是无状态协议，即后一个连接不会带有前一个连接的任何信息。但如果有session，后面的连接可以在被处理之前，找到存放在服务器中的数据。那么每个连接的sessionID如何保存，它被保存在客户端的cookie中。cookie中存放的相当于一把钥匙，这把钥匙可以打开存放在服务器的东西。

 

在flask中，请求环境入栈的时候，有下面的代码

if self.session is None:            session_interface = self.app.session_interface            self.session = session_interface.open_session(                self.app, self.request            )            if self.session is None:                self.session = session_interface.make_null_session(self.app)

如果请求环境的session为空，会根据请求和app中的信息创建session对象，如果创建失败会创建一个空的session

class SecureCookieSessionInterface(SessionInterface):    """The default session interface that stores sessions in signed cookies    through the :mod:`itsdangerous` module.    """    #: the salt that should be applied on top of the secret key for the    #: signing of cookie based sessions.    salt = 'cookie-session'    #: the hash function to use for the signature.  The default is sha1    digest_method = staticmethod(hashlib.sha1)    #: the name of the itsdangerous supported key derivation.  The default    #: is hmac.    key_derivation = 'hmac'    #: A python serializer for the payload.  The default is a compact    #: JSON derived serializer with support for some extra Python types    #: such as datetime objects or tuples.    serializer = session_json_serializer    session_class = SecureCookieSession    def get_signing_serializer(self, app):        if not app.secret_key:            return None        signer_kwargs = dict(            key_derivation=self.key_derivation,            digest_method=self.digest_method        )        return URLSafeTimedSerializer(app.secret_key, salt=self.salt,                                      serializer=self.serializer,                                      signer_kwargs=signer_kwargs)    def open_session(self, app, request):        s = self.get_signing_serializer(app)        if s is None:            return None        val = request.cookies.get(app.session_cookie_name)        if not val:            return self.session_class()        max_age = total_seconds(app.permanent_session_lifetime)        try:            data = s.loads(val, max_age=max_age)            return self.session_class(data)        except BadSignature:            return self.session_class()    def save_session(self, app, session, response):        domain = self.get_cookie_domain(app)        path = self.get_cookie_path(app)        # If the session is modified to be empty, remove the cookie.        # If the session is empty, return without setting the cookie.        if not session:            if session.modified:                response.delete_cookie(                    app.session_cookie_name,                    domain=domain,                    path=path                )            return        # Add a "Vary: Cookie" header if the session was accessed at all.        if session.accessed:            response.vary.add('Cookie')        if not self.should_set_cookie(app, session):            return        httponly = self.get_cookie_httponly(app)        secure = self.get_cookie_secure(app)        expires = self.get_expiration_time(app, session)        val = self.get_signing_serializer(app).dumps(dict(session))        response.set_cookie(            app.session_cookie_name,            val,            expires=expires,            httponly=httponly,            domain=domain,            path=path,            secure=secure        )

看上面代码中open_session方法，先根据app创建一个序列化对象s，然后查看request.cookies.get(app.session_cookie_name)是否存在，这个值就类似我们前面说的sessionID，如果值存在且通过s.loads方法反序列化成功，则return self.session_class(data)，返回用data初始化的session实例。如果值不存在或者反序列化失败，都是return self.session_class()返回没有初始化的session实例。

注意flask此处储存用户session数据的方法简化了，前面说的服务器会储存用户的session数据，一般是用数据库存储。但在flask中，数据序列化后直接存储在用户端的cookie中，不过序列化数据能提供一定的保密性。

 

self.session_class(data)用到的session类是SecureCookieSession

class SecureCookieSession(CallbackDict, SessionMixin):    """Base class for sessions based on signed cookies."""    def __init__(self, initial=None):        def on_update(self):            self.modified = True            self.accessed = True        super(SecureCookieSession, self).__init__(initial, on_update)        self.modified = False        self.accessed = False    def __getitem__(self, key):        self.accessed = True        return super(SecureCookieSession, self).__getitem__(key)    def get(self, key, default=None):        self.accessed = True        return super(SecureCookieSession, self).get(key, default)    def setdefault(self, key, default=None):        self.accessed = True        return super(SecureCookieSession, self).setdefault(key, default)

SecureCookieSession继承自werkzeug.datastructures模块的CallbackDict，CallbackDict实现了每次字典发生修改时，都会调用之前传入的函数的功能。这个功能的实现来自CallbackDict的父类UpdateDictMixin

class UpdateDictMixin(object):    """Makes dicts call `self.on_update` on modifications.    .. versionadded:: 0.5    :private:    """    on_update = None    def calls_update(name):        def oncall(self, *args, **kw):            rv = getattr(super(UpdateDictMixin, self), name)(*args, **kw)            if self.on_update is not None:                self.on_update(self)            return rv        oncall.__name__ = name        return oncall    def setdefault(self, key, default=None):        modified = key not in self        rv = super(UpdateDictMixin, self).setdefault(key, default)        if modified and self.on_update is not None:            self.on_update(self)        return rv    def pop(self, key, default=_missing):        modified = key in self        if default is _missing:            rv = super(UpdateDictMixin, self).pop(key)        else:            rv = super(UpdateDictMixin, self).pop(key, default)        if modified and self.on_update is not None:            self.on_update(self)        return rv    __setitem__ = calls_update('__setitem__')    __delitem__ = calls_update('__delitem__')    clear = calls_update('clear')    popitem = calls_update('popitem')    update = calls_update('update')    del calls_update

可以看到，UpdateDictMixin类中所有可以修改数据的方法，都进行改写。首先定义了calls_update装饰器，这样像__setitem__实际是经过装饰后的方法，在装饰器中会找到同名的原方法调用，并且在self.on_update不为空的情况下，调用self.on_update。

 

回到flask中用到的SecureCookieSession，他定义了on_update方位为修改modified和accessed属性为真。这两个属相在后面保存session的时候会用到。