Fix RuntimeError: The session is unavailable because no secret key was set in Flask

This error occurs when Flask tries to use the session but no SECRET_KEY is configured. Flask uses the secret key to cryptographically sign session cookies. Fix it by setting app.config['SECRET_KEY'] to a strong random value, ideally loaded from an environment variable rather than hardcoded in source code.

Reading the Stack Trace

Here's what each line means:

• File "/app/app/routes.py", line 8, in login: The login route tries to write to the session, triggering the secret key validation.
• File "/app/venv/lib/python3.12/site-packages/flask/sessions.py", line 100, in open_session: Flask's session module checks for a secret key before creating or opening a signed session cookie.
• RuntimeError: The session is unavailable because no secret key was set.: Flask refuses to create a session because without a secret key, the cookie cannot be cryptographically signed.

Common Causes

app = Flask(__name__)
# no app.config['SECRET_KEY'] = ...

@app.route('/login', methods=['POST'])
def login():
    session['user_id'] = 1  # crashes

app.config['SECRET_KEY'] = os.environ['SECRET_KEY']  # KeyError if not set

@app.before_request
def setup():
    session['visits'] = session.get('visits', 0) + 1  # too early

app.config['SECRET_KEY'] = 'my-secret'  # too late

The Fix

Set SECRET_KEY early in the application configuration, ideally from an environment variable. The fallback value is for local development only. In production, always set the SECRET_KEY environment variable to a strong random string.

app = Flask(__name__)

@app.route('/login', methods=['POST'])
def login():
    session['user_id'] = user.id
    return redirect(url_for('dashboard'))

import os

app = Flask(__name__)
app.config['SECRET_KEY'] = os.environ.get('SECRET_KEY', 'dev-fallback-key-change-in-production')

@app.route('/login', methods=['POST'])
def login():
    session['user_id'] = user.id
    return redirect(url_for('dashboard'))

Testing the Fix

import pytest
from app import create_app

@pytest.fixture
def client():
    app = create_app()
    app.config['TESTING'] = True
    app.config['SECRET_KEY'] = 'test-secret-key'
    return app.test_client()

def test_session_works_after_login(client):
    response = client.post('/login', json={'email': 'test@example.com', 'password': 'password'})
    assert response.status_code in (200, 302)

def test_session_persists_across_requests(client):
    with client.session_transaction() as sess:
        sess['user_id'] = 1
    response = client.get('/dashboard')
    assert response.status_code == 200

def test_secret_key_is_set(client):
    assert client.application.config['SECRET_KEY'] is not None
    assert len(client.application.config['SECRET_KEY']) > 0

Run your tests:

pytest tests/ -v

Pushing Through CI/CD

git checkout -b fix/flask-session-secret-key,git add app/__init__.py,git commit -m "fix: set SECRET_KEY from environment for session support",git push origin fix/flask-session-secret-key

Your CI config should look something like this:

name: CI
on:
  pull_request:
    branches: [main]
jobs:
  test:
    runs-on: ubuntu-latest
    env:
      SECRET_KEY: ci-test-secret-key
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
          cache: 'pip'
      - run: pip install -r requirements.txt
      - run: pytest tests/ -v --tb=short
      - run: flake8 app/

The Full Manual Process: 18 Steps

Here's every step you just went through to fix this one bug:

1. Notice the error alert or see it in your monitoring tool
2. Open the error dashboard and read the stack trace
3. Identify the file and line number from the stack trace
4. Open your IDE and navigate to the file
5. Read the surrounding code to understand context
6. Reproduce the error locally
7. Identify the root cause
8. Write the fix
9. Run the test suite locally
10. Fix any failing tests
11. Write new tests covering the edge case
12. Run the full test suite again
13. Create a new git branch
14. Commit and push your changes
15. Open a pull request
16. Wait for code review
17. Merge and deploy to production
18. Monitor production to confirm the error is resolved

Total time: 30-60 minutes. For one bug.

pip install bugstack

import bugstack

bugstack.init(api_key=os.environ["BUGSTACK_API_KEY"])

Deploying the Fix (Manual Path)

1. Run pytest locally to confirm sessions work with the secret key set.
2. Open a pull request with the configuration change.
3. Wait for CI checks to pass on the PR.
4. Have a teammate review and approve the PR.
5. Merge to main, set the SECRET_KEY environment variable in production, and verify sessions work in staging.

Frequently Asked Questions