Decode a Flask cookie with Rust

decode_flask_cookie.rs

use flate2::read::ZlibDecoder;
use ring::hmac;
use std::convert::TryInto;
use std::io::Read;
use std::time::{Duration, SystemTime};

fn decode_flask_cookie(
    cookie: &str,
    secret: &str,
    salt: &str,
    hmac_digest: hmac::Algorithm,
) -> (String, SystemTime) {
    let mut parts = cookie.rsplitn(2, '.');
    let signature = base64::decode_config(parts.next().unwrap(), base64::URL_SAFE).unwrap();
    let payload = parts.next().unwrap();
    // Verify signature
    // Flask defaults (https://github.com/pallets/flask/blob/master/src/flask/sessions.py):
    // salt = "cookie-session"
    // digest_method = staticmethod(hashlib.sha1)
    // key_derivation = "hmac"
    let key = hmac::Key::new(hmac_digest, secret.as_bytes());
    let derived_key = hmac::sign(&key, salt.as_bytes());
    let key = hmac::Key::new(hmac_digest, derived_key.as_ref());
    let verified = hmac::verify(&key, payload.as_bytes(), &signature);
    if verified.is_ok() && payload.starts_with('.') {
        // Decode payload
        // Following Python implementation from
        // https://www.kirsle.net/wizards/flask-session.cgi and
        // https://programmer.group/flask-source-parsing-session.html
        let parts: Vec<&str> = payload.split('.').collect();
        if parts.len() == 3 {
            let mut decoded = parts[1..]
                .iter()
                .map(|part| base64::decode_config(part, base64::URL_SAFE).unwrap());

            let data_u8 = decoded.next().unwrap();
            let mut gz = ZlibDecoder::new(&data_u8[..]);
            let mut data = String::new();
            gz.read_to_string(&mut data).unwrap();

            let timestamp_u8 = decoded.next().unwrap();
            let ts_secs = u32::from_be_bytes(timestamp_u8[..].try_into().unwrap());
            let timestamp = SystemTime::UNIX_EPOCH
                .checked_add(Duration::from_secs(ts_secs.into()))
                .unwrap();

            return (data, timestamp);
        }
    }
    return (String::new(), SystemTime::now());
}

fn main() {
    use chrono::{DateTime, Local};
    let (data, timestamp) = decode_flask_cookie(".eJxVkbtuwzAMRX-l0NApsCXrZRkI2r1L_yCQKCoR6hckuR2C_HvlukO7Ebz3gofknVxCwnwjQ0kbnsglejKQzlMMErVA5JZZ4LQz1qGlCrRWjiLTiupO8ECDVkJ4bYVzhulgDOuEd1JyQN4LgYI7bqwCUNAxbZiQzghwEpU0Rle5870IVDrQIANyDlwpciJbxkSGO8HJxrEirR_2NS9bAlyXERu4Vc9sJ6zSe0xTnJ_e7Ogw1dSJrBHKlnbtVsqah7bNCLXRXJP9tMWmBpapPcrWS6adAMGMCQoUghaCUs57qjRw7F7yuafP_hw9ziXCMu8DEgZMCf1l5_zlqIg_0hLi-Hf2NZbmH3p7OPPm9lvX6gtdjmXPkMex-vGH3ff4Bt0qgog.XdhkSQ.DDdAFDv2wbNTPlMwpG_6yTvBvQg",
                                                "dev", "cookie-session", hmac::HMAC_SHA1_FOR_LEGACY_USE_ONLY);
    println!("{}", data);
    println!("{:?}", DateTime::<Local>::from(timestamp));
}