How are Flask-Security tokens created?
<p>I'm trying to understand how <code>flask-security</code> token creation works. I have a secret key in my <code>flask</code> app configuration, but our code is open source and in python, so it's not very secret, really. </p>

<p>I have the ability in the code to access the serializer that created the token:</p>

<pre><code>    serializer = current_app.extensions['security'].remember_token_serializer
</code></pre>

<p>And then I can do <code>serializer.loads(token)</code> and receive the username and the hashed password.</p>

<p>So my question is this: what prevents a malicious user listening to my traffic, that has the secret key, from doing the same thing - getting a <code>flask-security</code> token serializer, and deserializing my token? Is there some other salt that <code>flask</code> uses when creating the tokens? But then, how would it decipher the token if the service was to be restarted?</p>