This is what I have settled on so far btw. 1. Store session data on server side (use redis for storage) 2. Only exhcnage session id b/w client and server usin

This is what I have settled on so far btw. 1. Store session data on server side (use redis for storage) 2. Only exhcnage session id b/w client and server using cookies (serialized using pickle ?) 3. Regenerate session id after login ? Is this needed though ?