flask • python • session cookie

Flask session cookie manager

What is a good way to test a flask web application routes/page that requires a user to login first? In my opinion there is two ways of doing it.

  1. do a setup and teardown where you login and logout after each test
  2. Inject session cookie for all request (This will help speed up the test suite you have, because you don’t have to set the login/logout at the beginning and the end of test)

Below is a simple python script to deal with Flask session cookie

What you will need the:

  1. flask app secret key (for encoding)
  2. the session cookie structure/data for (decoding/encoding)

How to use the python script:

  1. Use the session_cookie_decoder to get session cookie data/structure python session_cookie_manager.py <decode> <session_cookie_value>
  2. Use the session_cookie_encoder to setup a stub/mock session cookie data python session_cookie_manager.py <encode> <secret_key> <session_cookie_structure>

session_cookie_manager.py

""" Flask Session Cookie Decoder/Encoder """ __author__ = 'Wilson Sumanang' # standard imports import sys import zlib from itsdangerous import base64_decode # external Imports from flask.sessions import SecureCookieSessionInterface class MockApp(object): def __init__(self, secret_key): self.secret_key = secret_key def session_cookie_encoder(secret_key, session_cookie_structure): """ Encode a Flask session cookie  Example:  cookie_structure = dict( 	gplus_id = 1285135705050360459231,  email = john.doe@gmail.com,  user_info = dict(  full_name = john doe,  )  )  session_cookie_encoder(b'development key', cookie_structure)  Args:  secret_key (string): Flask App secret key  session_cookie_structure (dict): Flask session cookie structure  Return:  value (string): Flask session cookie  """ try: app = MockApp(secret_key) session_cookie_structure = dict() si = SecureCookieSessionInterface() s = si.get_signing_serializer(app) return s.dumps(session_cookie_structure) except Exception as e: return "[Encoding error]{}".format(e) def session_cookie_decoder(session_cookie_value): """ Decode a Flask cookie  Args:  session_cookie_value (string): Flask session cookie to decode  """ try: compressed = False payload = session_cookie_values if payload.startswith(b'.'): compressed = True payload = payload[1:] data = payload.split(".")[0] data = base64_decode(data) if compressed: data = zlib.decompress(data) return data except Exception as e: return "[Decoding error]{}".format(e) if __name__ == "__main__": encoder_guide = "Usage: session_cookie_manager.py <encode> <secret_key> <session_cookie_structure>" decoder_guide = "Usage: session_cookie_manager.py <decode> <session_cookie_value>" print sys.argv if len(sys.argv) == 3: status, session_cookie_value = sys.argv[1:] if status.lower() == 'decode': print session_cookie_decoder(session_cookie_value) else: print decoder_guide sys.exit(1) elif len(sys.argv) == 4: status, secret_key, session_cookie_structure = sys.argv[1:] if status.lower() == 'encode': print session_cookie_encoder(secret_key, session_cookie_structure) sys.exit(1) else: print encoder_guide else: print decoder_guide print encoder_guide sys.exit(1)

By default Flask uses URL-safe signed serializer called itsdangerous to encoded its client-side session cookie. A flask app uses a secret key to sign the session cookie so that the client can’t modify it.1

  1. https://www.kirsle.net/wizards/flask-session.py ↩