Example of signed_in area with secure_cookies on Tornado

server_secure_cookies.py

# coding: utf-8
import tornado.ioloop
import tornado.web
from db import users

class HomeHandler(tornado.web.RequestHandler):
    def get(self):
        if 'signed_in' == self.get_secure_cookie('access'):
            self.write('Hello to your world!')
        else:
            self.write('Hello, world!')

class SigninHandler(tornado.web.RequestHandler):
    def post(self):
        if self.get_attribute('login') in users:
            self.set_secure_cookie('access', 'signed_in', expires_days=None)
        self.redirect('/')

class SignoutHandler(tornado.web.RequestHandler):
    def get(self):
        self.clear_cookie('access')
        self.redirect('/')

application = tornado.web.Application([
    (r"/", HomeHandler), (r"/signin", SigninHandler),
    (r"/signout", SignoutHandler),
], **{
    'cookie_secret': 'i_should_be_reading_that_from_env'
})

if __name__ == "__main__":
    application.listen(8888)
    tornado.ioloop.IOLoop.instance().start()