I have two requirements for my Flask session (that I use to keep user information after a successful SAML login):

(1) The session must time out after 60 minutes.
(2) The session must terminate on browser close

I know that I can achieve the session timeout as follows:

session.permanent = True
app.permanent_session_lifetime = timedelta(minutes=5)

But doing that also leads to the session not terminating on browser close since we are setting session.permanent to True.

Is there a way to achieve both conditions without “hacks” like this that detect browser close events in JavaScript?