When the session modified such that it ends up empty, the session cookie is deleted by sending an expired cookie. This 'deletion cookie' is missing the HttpOnly flag. The bug is in the call to delete_cookie, which is missing the httponly kwarg.

from flask import Flask, session
app = Flask(__name__)
app.secret_key = "whatever"
app.config['SESSION_COOKIE_HTTPONLY'] = True # the default
@app.route('/')
def index():
    session['foo'] = 1  # sets session.modified
    session.pop('foo')  # afterwards, the session is empty again
    return ""
app.run()

expected behavior: the HttpOnly flag should be present on the 'deletion cookie'.

Environment:

• Python version: 3.10.2
• Flask version: 2.0.3