Non-expiring Infinite Sessions

aiohttpsession has non-expiring infinite sessions. The cause of the vulnerability is due to lack of inherent data expiration in EncryptedCookieStorage and NaClCookieStorage...

Session Fixation

aiohttpsession is vulnerable to session fixation attacks. A malicious user with access to a valid cookie can inject the cookie into another user's browser to gain control of that user's session...