Decode a Flask Session cookie, given the cookie and secret key

decode_flask_cookie.py

def decode_flask_cookie(secret_key, cookie_str):
    import hashlib
    from itsdangerous import URLSafeTimedSerializer
    from flask.sessions import TaggedJSONSerializer
    salt = 'cookie-session'
    serializer = TaggedJSONSerializer()
    signer_kwargs = {
        'key_derivation': 'hmac',
        'digest_method': hashlib.sha1
    }
    s = URLSafeTimedSerializer(secret_key, salt=salt, serializer=serializer, signer_kwargs=signer_kwargs)
    return s.loads(cookie_str)

Based on https://github.com/mitsuhiko/flask/blob/84a12afd4dff0c58aceb34c7fc93e3eedbe5005f/flask/sessions.py

I think it's easier and more robust to use class inheritance. Take a look at my gist:

https://gist.github.com/aescalana/7e0bc39b95baa334074707f73bc64bfe

itsdangerous recently switched to sha512, so depending upon which version of itsdangerous you are using you may need a hashlib.sha512 digest_method

pallets/itsdangerous@24ff676#diff-e4eb329834da3d36278b1b7d943b3bc9R11

Current line in sessions.py still uses hashlib.sha1

https://github.com/pallets/flask/blob/96726f6a04251bde39ec802080c9008060e0b5b9/src/flask/sessions.py#L316