def open_session(self, app, request):
session_key = request.cookies.get(app.session_cookie_name)<EOL>if not session_key:<EOL><INDENT>found = False<EOL>for path in self.allowed_no_session:<EOL><INDENT>if request.path.startswith(str(path)):<EOL><INDENT>found = True<EOL>break<EOL><DEDENT><DEDENT>if not found:<EOL><INDENT>app.logger.debug("<STR_LIT>", request.path,<EOL>[str(url) for url in self.allowed_no_session])<EOL>raise PermissionDenied("<STR_LIT>")<EOL><DEDENT><DEDENT>session_data = {}<EOL>try:<EOL><INDENT>session_data = json.loads(crypt.decrypt(<EOL>session_key, passphrase=self.secret_key))<EOL><DEDENT>except (IndexError, TypeError, ValueError) as _:<EOL><INDENT>pass<EOL><DEDENT>return self.session_class(initial=session_data, session_key=session_key)<EOL>
We load the data from the key itself instead of fetching from
some external data store. Opposite of _get_session_key(),
raises BadSignature if signature fails.

  $ echo '_json_formatted_' | openssl aes-256-cbc -a -k _passphrase_ -p
  salt=...
  key=...
  iv=...
  _full_encrypted_