Flask session cookie decoder

Flask stores the whole session in the cookie, signed but not encrypted. Like a JWT, the contents are readable by anyone holding the cookie - so the first move on any Flask challenge is to decode your own session and see what the application is tracking.

Reading the format

The cookie is three dot-separated parts: payload, timestamp, signature. A leading . on the payload means it was zlib-compressed before Base64 encoding - decompress after decoding or you will see binary noise and conclude wrongly that it is encrypted.

• Payload - Base64-URL encoded JSON, optionally zlib-compressed.
• Timestamp - when it was signed, in itsdangerous' own epoch.
• Signature - HMAC over the first two, keyed by a value derived from the app’s SECRET_KEY.

Forging needs the secret key

Reading is free; modifying requires the SECRET_KEY. Challenges leak it through debug pages, a git directory, an exposed config file, or by being weak enough to guess from a wordlist. Once you hold it, re-signing an arbitrary session - admin: true and all - is legitimate signing, and the application will accept it.