Is it more secure to use itsdangerous with Flask-Login without the remember me option? Why or why not?

I am learning how to create a Flask app using a MongoDB database by putting together a user authentication system. When I went through the code with my superior at work, he said using werkzeug.security for hashing passwords may not be a good idea and asked me to make use of itsdangerous library in my code (below).

What has been driving me insane is I couldn't find anywhere online why using werkzeug.security on its own is a bad idea. As far as I can gather itsdangerous package lets you use a login serialiser to encrypt and decrypt the cookie token when you use the remember me option in Flask-Login (I am not using this option). I found this article explaining Flask-Login tokens.

Is it still important to use itsdangerous even if I don't use the remember me option?

from flask import Flask, url_for, redirect, render_template, request
from flask_mongoengine import MongoEngine
from wtforms import form, fields, validators
from werkzeug.security import generate_password_hash, check_password_hash
import flask_login

# Create application
app = Flask(__name__)

# Create a secret key so we can use sessions
app.config['SECRET_KEY'] = 'super-secret'

# MongoDB settings
app.config['MONGODB_SETTINGS'] = {'DB': 'mymongodb'}
db = MongoEngine()
db.init_app(app)

# Create user document (MongoDB documents are like rows in a relational table).
class User(db.Document):
    login = db.StringField(max_length=80, unique=True)
    password = db.StringField(max_length=80)
    email = db.StringField(max_length=80)
    name = db.StringField(max_length=80)

    # Flask-Login integration
    def is_authenticated(self):
        return True

    def is_active(self):
        return True

    def is_anonymous(self):
        return False

    def get_id(self):
        return str(self.id)

# Define login and registration forms (for flask-login)
class LoginForm(form.Form):
    login = fields.StringField(validators=[validators.required()])
    password = fields.PasswordField(validators=[validators.required()])

    def validate_login(self, field):
        user = self.get_user()

        if user is None:
            raise validators.ValidationError('Invalid username.')

        if not check_password_hash(user.password, self.password.data):
            raise validators.ValidationError('Invalid password.')

    def get_user(self):
        return User.objects(login=self.login.data).first()

class RegistrationForm(form.Form):
    login = fields.StringField(validators=[validators.required(),validators.length(min=3, max=80)])
    password = fields.PasswordField(validators=[validators.required(), validators.length(min=6, max=80)])
    email = fields.StringField(validators=[validators.required(),validators.email(), validators.length(min=6, max=80)])
    name = fields.StringField(validators=[validators.required(), validators.length(min=3, max=80)])

    def validate_login(self, field):
        if User.objects(login=self.login.data):
            raise validators.ValidationError('Duplicate username.')

# Initialise flask-login
def init_login():
    login_manager = flask_login.LoginManager()
    login_manager.init_app(app)

    # Create user loader function
    @login_manager.user_loader
    def load_user(user_id):
        return User.objects(id=user_id).first()

# Flask views

@app.route('/', methods=('GET', 'POST'))
@app.route('/login/', methods=('GET', 'POST'))
def login_view():
    form = LoginForm(request.form)
    if request.method == 'POST' and form.validate():
        user = form.get_user()
        flask_login.login_user(user)
        return render_template('main.html', user=flask_login.current_user)

    return render_template('form.html', form=form)

@app.route('/register/', methods=('GET', 'POST'))
def register_view():
    form = RegistrationForm(request.form)
    if request.method == 'POST' and form.validate():
        hashpass = generate_password_hash(form.password.data, method='sha256', salt_length=8)
        user = User(form.login.data, hashpass, form.email.data, form.name.data)
        user.save()

        flask_login.login_user(user)
        return render_template('main.html', user=flask_login.current_user)

    return render_template('form.html', form=form)

@app.route('/logout/')
def logout_view():
    flask_login.logout_user()
    return redirect(url_for('login_view'))

@app.route('/main/')
def main_view():
    if flask_login.current_user.is_authenticated:
        return render_template('main.html', user=flask_login.current_user)
    return redirect(url_for('login_view'))

@app.route('/map/')
def map_view():
    if flask_login.current_user.is_authenticated:
        return render_template('map.html', user=flask_login.current_user)
    return redirect(url_for('login_view'))

if __name__ == '__main__':
    # Initialise flask-login
    init_login()

    # Start the Flask app
    app.run(debug=True)

Thanks, Aina.

generate_password_hash is a function for securely hashing passwords. ItsDangerous is a library for securely signing (but not hashing or encrypting) arbitrary data. ItsDangerous would not be appropriate for hashing passwords.

Since you're using Flask-Login, it will handle cookies for you. You would not use ItsDangerous directly in that case. Flask uses ItsDangerous behind the scenes to sign the session cookie.