sessions documentation (client side vs server side) #434

[dawranliou]

Mention the existence of Flask extentions that handle server-side sessions

---

This change is

[dawranliou]

PR for #434

[untitaker]

We should go into a lot more detail and actually list extensions that do this.

[untitaker]

Also the text above is very explicit about where sessions get stored (cookies). It can't harm to restate for clarity, but as of now the reading flow is a bit awkward IMO

[jeffwidman]

We should go into a lot more detail and actually list extensions that do this.

@untitaker I'm hesitant to go into much detail here because this is the quickstart, so we want to keep it quick, especially when Flask's default client-side sessions suffice for most use cases. Primarily I thought we could add a sentence to make n00b web-devs aware of the existence of server-side sessions and they can google if they want more.

Also, I don't know what our policy is on recommending specific extensions, I'm generally a little hesitant because there's no guarantees about them being maintained. In particular for sessions, even when the extension is well-maintained, there are potential security implications if anything is amiss... for example mbr/flask-kvsession#25 (comment)

[untitaker]

I overlooked that this was the quickstart. At some point sessions might have to get its own page, if we want to list extensions.

I still insist about the reading flow being bad. The paragraph above talks about sessions being stored entirely client side and this one opens with "Sessions are stored clientside" as if that wasn't already established.

[untitaker]

Hey @dawran6, are you still interested in pushing this PR forward?

[dawranliou]

Hey @untitaker , @jeffwidman , sorry for taking so long. I only changed a bit on the transition words. What do you guys think?

[untitaker]

LGTM, definetly an improvement. Thanks!