Store session after callbacks. This fixes #351

flask/app.py

@@ -1403,8 +1403,6 @@ class Flask(_PackageBoundObject):
         """
         ctx = _request_ctx_stack.top
         bp = ctx.request.blueprint
-        if not self.session_interface.is_null_session(ctx.session):
-            self.save_session(ctx.session, response)
         funcs = ()
         if bp is not None and bp in self.after_request_funcs:
             funcs = reversed(self.after_request_funcs[bp])
@@ -1412,6 +1410,8 @@ class Flask(_PackageBoundObject):
             funcs = chain(funcs, reversed(self.after_request_funcs[None]))
         for handler in funcs:
             response = handler(response)
+        if not self.session_interface.is_null_session(ctx.session):
+            self.save_session(ctx.session, response)
         return response
 
     def do_teardown_request(self):

flask/testsuite/basic.py

@@ -279,6 +279,23 @@ class BasicFunctionalityTestCase(FlaskTestCase):
         match = re.search(r'\bexpires=([^;]+)', rv.headers['set-cookie'])
         self.assert_(match is None)
 
+    def test_session_stored_last(self):
+        app = flask.Flask(__name__)
+        app.secret_key = 'development-key'
+        app.testing = True
+
+        @app.after_request
+        def modify_session(response):
+            flask.session['foo'] = 42
+            return response
+        @app.route('/')
+        def dump_session_contents():
+            return repr(flask.session.get('foo'))
+
+        c = app.test_client()
+        self.assert_equal(c.get('/').data, 'None')
+        self.assert_equal(c.get('/').data, '42')
+
     def test_flashes(self):
         app = flask.Flask(__name__)
         app.secret_key = 'testkey'