I think instead of string operations the proper way to check whether it's an IP is using socket.inet_pton() and returning True if it doesn't raise, otherwise False.

Something like this:

for family in (socket.AF_INET, socket.AF_INET6):
    try:
        socket.inet_pton(family, ip)
    except socket.error:
        pass
    else:
        return True
return False

@ThiefMaster What should be the category of the warning message?

maybe RuntimeWarning... I'd check if Flask uses any other warnings (that are not deprecation-related) and possibly use the same type

Also, tests are failing since you don't handle the case where the domain is unset, i.e. None

@ThiefMaster How can I get the socket of the session when I call the function is_ip() in the save_session() function?

It's a function from python's socket module, so you simple import socket at the top of the file...

@ThiefMaster Sorry for that, in my last commit all the unit tests are passing. I also did the changes you asked for.

@untitaker can you make a decision on this?

Setting SESSION_COOKIE_DOMAIN = '127.0.0.1:5000' works fine. The issue is when it's detected through SERVER_NAME instead, in which case Flask adds a '.' before the "domain", which Chrome doesn't like (rightly so, an IP isn't a domain). We can just use the is_ip function to decide to remove the '.' prefix and things will work as expected.

I don't like running is_ip for every request when ideally domain will not be an IP.

Continued in #2282.