larzsession

Signed cookie sessions + CSRF tokens. Pure Python, zero dependencies.

Store session data in a tamper-proof cookie the client can't forge — it's serialized, timestamped, and HMAC-signed, so any change invalidates it and you can expire it by age. No database, no session store: the signature is the security. Also generates/validates CSRF tokens and formats hardened Set-Cookie headers.

from larzsession import Serializer

s = Serializer("my-secret-key")
token = s.dumps({"user_id": 42, "role": "admin"})   # -> cookie value
s.loads(token, max_age=3600)                        # {'user_id': 42, ...}, or raises

Why

• No server-side store. The signed cookie is the session — stateless auth that scales horizontally with nothing shared.
• Tamper-proof + expirable. HMAC-SHA256 with a derived key; a timestamp lets you enforce max_age. Tampering raises BadSignature; old tokens raise SignatureExpired.
• CSRF built in. CSRF(secret).generate() / .validate(token) for signed, expiring CSRF tokens.
• Hardened cookies. cookie() emits HttpOnly; Secure; SameSite=Lax by default.
• Zero dependencies. Pure hmac/hashlib — no itsdangerous.

Install

pip install larzsession

Usage

from larzsession import Serializer, CSRF, cookie

s = Serializer("secret")
tok = s.dumps({"uid": 1})
data = s.loads(tok, max_age=86400)

csrf = CSRF("secret")
t = csrf.generate(); csrf.validate(t)

set_cookie = cookie("session", tok, max_age=86400, samesite="Strict")
# 'session=...; Max-Age=86400; Path=/; Secure; HttpOnly; SameSite=Strict'

Lower-level Signer / TimestampSigner are exposed too. Built on the same HMAC primitives as larzcrypt.

Tests

python -m unittest discover -s tests -v   # 13 tests

The Larz stack

One of 30+ pure-Python, zero-dependency libraries at github.com/larz-scripter.

License

MIT © larz-scripter