title: Flask permanent session: where to define them?
body: <p>By default, Flask uses volatile sessions, which means the session cookie is set to expire when browser closes.   In order to use permanent sessions, which will use a cookie with a defined expiration date, one should set <code>session.permanent = True</code>, as is <a href="https://stackoverflow.com/questions/11783025/is-there-an-easy-way-to-make-sessions-timeout-in-flask">mentioned in this question.</a>, and the expiration date will be set based on <code>config['PERMANENT_SESSION_LIFETIME']</code>.  </p>
  
  <p>I am surprised that session lifetime is defined in config file, yet it is not possible to request the use of permanent sessions through configuration, such as a <code>config['USE_PERMANENT_SESSION'] = True</code>.   But so be it.</p>
  
  <p>My question is: if you <em>do</em> want permanent sessions, what is the best place to define them ?   Is it in an <code>@app.before_request</code> function as proposed in mentioned question ?   But that would mean setting it over again at each request ?   It seems that once set, <code>session.permanent</code> remains true till end of session.   </p>
  
  <p>Permanent sessions are generally used <em>after sign-in</em>, so maybe the best place to request them is while processing <code>login_user()</code> ?     So is the best policy to  use volatile session cookies for all anonymous pages, and switch to permanent sessions by doing a <code>session.permanent = True</code> at sign-in ?</p>
  
  <p>And one might want to set a different lifetime depending on whether it is the ordinary <code>session</code> cookie, or the <code>remember_me</code> cookie.   What would be the best way to achieve this ?</p>