---
id: aiohttp-session
version: "2.12.1"
license: Apache 2
license_treatment: permissive
maintenance: active
---

# aiohttp-session — sessions for aiohttp.web

License: permissive · Maintenance: active · Downloads: 223.1K/mo

## What it is and what it does

aiohttp_session is a middleware library that adds session support to aiohttp.web applications. It provides a dict-like interface for storing and retrieving user-specific data across HTTP requests, with the session identifier stored in an HTTP cookie named AIOHTTP_SESSION (customizable via the storage class).

The library offers three main storage backends: SimpleCookieStorage (plain JSON in cookie, for testing only), EncryptedCookieStorage (encrypted cookie storage), and RedisStorage (server-side storage in Redis with only the session key in the cookie). You register the session middleware with your aiohttp Application via the setup() function, then retrieve the session object in handlers using get_session(request). The session automatically handles expiration, TTL management, and cookie attributes.

Use it for:

- Store user login state and authentication tokens across requests in a web application.
- Track user preferences or UI state without a database.
- Maintain shopping cart or form data during multi-step workflows in async web apps.
- Use Redis as a centralized session store for load-balanced aiohttp deployments.
- Persist session data with automatic expiration and TTL management.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Provides session management for aiohttp.web applications with dict-like access to user-specific data, supporting multiple storage backends including encrypted cookies, Redis, and Memcached.

Yes. This is the standard session middleware for aiohttp.web with low install friction, active maintenance, no known vulnerabilities, and a permissive license. Install it if you are building an aiohttp web application that needs to track user state across requests. Choose your storage backend based on security and scalability needs.

## Install

pip install aiohttp-session
uv add aiohttp-session
poetry add aiohttp-session

## Installing aiohttp-session

Before you install: Low friction—pure Python wheel with a single runtime dependency (aiohttp). Actively maintained as of 2024-09-25 with recent typing fixes and ongoing Python version support through 3.13.

License in practice: Apache 2 (permissive): you may use, modify, and distribute this package freely in commercial and private projects, provided you retain the license notice.

Quickstart:

from aiohttp import web
from aiohttp_session import setup, get_session
from aiohttp_session.cookie_storage import EncryptedCookieStorage

async def handler(request):
    session = await get_session(request)
    session['key'] = 'value'
    return web.Response(text='OK')

app = web.Application()
setup(app, EncryptedCookieStorage(fernet_key))
app.router.add_get('/', handler)

EncryptedCookieStorage requires an external encryption library; RedisStorage requires a Redis client library. Install optional dependencies via pip install aiohttp_session[secure] or aiohttp_session[aioredis].

Verify before relying:

- Whether SimpleCookieStorage is suitable for any production use cases despite documentation warnings.
- Performance characteristics and scalability limits when using Redis or Memcached backends under high concurrency.
- Exact encryption algorithm and key length requirements for EncryptedCookieStorage.

## Package facts

- License: Apache 2 (permissive)
- Python support: unspecified
- Install friction: low
- Maintenance: active
- Downloads: 223.1K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

aiohttp session management, async web session storage, encrypted cookie sessions, redis session backend, aiohttp middleware sessions, user data persistence aiohttp, memcached session storage, async-web, session-management, middleware

[View on SkillFed](https://skillfed.io/packages/aiohttp-session) · [View on PyPI](https://pypi.org/project/aiohttp-session/)