before send to remote

env/lib/python3.8/site-packages/django/contrib/sessions/backends/base.py

@@ -0,0 +1,365 @@
+import logging
+import string
+from datetime import datetime, timedelta
+
+from django.conf import settings
+from django.core import signing
+from django.utils import timezone
+from django.utils.crypto import get_random_string
+from django.utils.module_loading import import_string
+
+# session_key should not be case sensitive because some backends can store it
+# on case insensitive file systems.
+VALID_KEY_CHARS = string.ascii_lowercase + string.digits
+
+
+class CreateError(Exception):
+    """
+    Used internally as a consistent exception type to catch from save (see the
+    docstring for SessionBase.save() for details).
+    """
+
+    pass
+
+
+class UpdateError(Exception):
+    """
+    Occurs if Django tries to update a session that was deleted.
+    """
+
+    pass
+
+
+class SessionBase:
+    """
+    Base class for all Session classes.
+    """
+
+    TEST_COOKIE_NAME = "testcookie"
+    TEST_COOKIE_VALUE = "worked"
+
+    __not_given = object()
+
+    def __init__(self, session_key=None):
+        self._session_key = session_key
+        self.accessed = False
+        self.modified = False
+        self.serializer = import_string(settings.SESSION_SERIALIZER)
+
+    def __contains__(self, key):
+        return key in self._session
+
+    def __getitem__(self, key):
+        return self._session[key]
+
+    def __setitem__(self, key, value):
+        self._session[key] = value
+        self.modified = True
+
+    def __delitem__(self, key):
+        del self._session[key]
+        self.modified = True
+
+    @property
+    def key_salt(self):
+        return "django.contrib.sessions." + self.__class__.__qualname__
+
+    def get(self, key, default=None):
+        return self._session.get(key, default)
+
+    def pop(self, key, default=__not_given):
+        self.modified = self.modified or key in self._session
+        args = () if default is self.__not_given else (default,)
+        return self._session.pop(key, *args)
+
+    def setdefault(self, key, value):
+        if key in self._session:
+            return self._session[key]
+        else:
+            self.modified = True
+            self._session[key] = value
+            return value
+
+    def set_test_cookie(self):
+        self[self.TEST_COOKIE_NAME] = self.TEST_COOKIE_VALUE
+
+    def test_cookie_worked(self):
+        return self.get(self.TEST_COOKIE_NAME) == self.TEST_COOKIE_VALUE
+
+    def delete_test_cookie(self):
+        del self[self.TEST_COOKIE_NAME]
+
+    def encode(self, session_dict):
+        "Return the given session dictionary serialized and encoded as a string."
+        return signing.dumps(
+            session_dict,
+            salt=self.key_salt,
+            serializer=self.serializer,
+            compress=True,
+        )
+
+    def decode(self, session_data):
+        try:
+            return signing.loads(
+                session_data, salt=self.key_salt, serializer=self.serializer
+            )
+        except signing.BadSignature:
+            logger = logging.getLogger("django.security.SuspiciousSession")
+            logger.warning("Session data corrupted")
+        except Exception:
+            # ValueError, unpickling exceptions. If any of these happen, just
+            # return an empty dictionary (an empty session).
+            pass
+        return {}
+
+    def update(self, dict_):
+        self._session.update(dict_)
+        self.modified = True
+
+    def has_key(self, key):
+        return key in self._session
+
+    def keys(self):
+        return self._session.keys()
+
+    def values(self):
+        return self._session.values()
+
+    def items(self):
+        return self._session.items()
+
+    def clear(self):
+        # To avoid unnecessary persistent storage accesses, we set up the
+        # internals directly (loading data wastes time, since we are going to
+        # set it to an empty dict anyway).
+        self._session_cache = {}
+        self.accessed = True
+        self.modified = True
+
+    def is_empty(self):
+        "Return True when there is no session_key and the session is empty."
+        try:
+            return not self._session_key and not self._session_cache
+        except AttributeError:
+            return True
+
+    def _get_new_session_key(self):
+        "Return session key that isn't being used."
+        while True:
+            session_key = get_random_string(32, VALID_KEY_CHARS)
+            if not self.exists(session_key):
+                return session_key
+
+    def _get_or_create_session_key(self):
+        if self._session_key is None:
+            self._session_key = self._get_new_session_key()
+        return self._session_key
+
+    def _validate_session_key(self, key):
+        """
+        Key must be truthy and at least 8 characters long. 8 characters is an
+        arbitrary lower bound for some minimal key security.
+        """
+        return key and len(key) >= 8
+
+    def _get_session_key(self):
+        return self.__session_key
+
+    def _set_session_key(self, value):
+        """
+        Validate session key on assignment. Invalid values will set to None.
+        """
+        if self._validate_session_key(value):
+            self.__session_key = value
+        else:
+            self.__session_key = None
+
+    session_key = property(_get_session_key)
+    _session_key = property(_get_session_key, _set_session_key)
+
+    def _get_session(self, no_load=False):
+        """
+        Lazily load session from storage (unless "no_load" is True, when only
+        an empty dict is stored) and store it in the current instance.
+        """
+        self.accessed = True
+        try:
+            return self._session_cache
+        except AttributeError:
+            if self.session_key is None or no_load:
+                self._session_cache = {}
+            else:
+                self._session_cache = self.load()
+        return self._session_cache
+
+    _session = property(_get_session)
+
+    def get_session_cookie_age(self):
+        return settings.SESSION_COOKIE_AGE
+
+    def get_expiry_age(self, **kwargs):
+        """Get the number of seconds until the session expires.
+
+        Optionally, this function accepts `modification` and `expiry` keyword
+        arguments specifying the modification and expiry of the session.
+        """
+        try:
+            modification = kwargs["modification"]
+        except KeyError:
+            modification = timezone.now()
+        # Make the difference between "expiry=None passed in kwargs" and
+        # "expiry not passed in kwargs", in order to guarantee not to trigger
+        # self.load() when expiry is provided.
+        try:
+            expiry = kwargs["expiry"]
+        except KeyError:
+            expiry = self.get("_session_expiry")
+
+        if not expiry:  # Checks both None and 0 cases
+            return self.get_session_cookie_age()
+        if not isinstance(expiry, (datetime, str)):
+            return expiry
+        if isinstance(expiry, str):
+            expiry = datetime.fromisoformat(expiry)
+        delta = expiry - modification
+        return delta.days * 86400 + delta.seconds
+
+    def get_expiry_date(self, **kwargs):
+        """Get session the expiry date (as a datetime object).
+
+        Optionally, this function accepts `modification` and `expiry` keyword
+        arguments specifying the modification and expiry of the session.
+        """
+        try:
+            modification = kwargs["modification"]
+        except KeyError:
+            modification = timezone.now()
+        # Same comment as in get_expiry_age
+        try:
+            expiry = kwargs["expiry"]
+        except KeyError:
+            expiry = self.get("_session_expiry")
+
+        if isinstance(expiry, datetime):
+            return expiry
+        elif isinstance(expiry, str):
+            return datetime.fromisoformat(expiry)
+        expiry = expiry or self.get_session_cookie_age()
+        return modification + timedelta(seconds=expiry)
+
+    def set_expiry(self, value):
+        """
+        Set a custom expiration for the session. ``value`` can be an integer,
+        a Python ``datetime`` or ``timedelta`` object or ``None``.
+
+        If ``value`` is an integer, the session will expire after that many
+        seconds of inactivity. If set to ``0`` then the session will expire on
+        browser close.
+
+        If ``value`` is a ``datetime`` or ``timedelta`` object, the session
+        will expire at that specific future time.
+
+        If ``value`` is ``None``, the session uses the global session expiry
+        policy.
+        """
+        if value is None:
+            # Remove any custom expiration for this session.
+            try:
+                del self["_session_expiry"]
+            except KeyError:
+                pass
+            return
+        if isinstance(value, timedelta):
+            value = timezone.now() + value
+        if isinstance(value, datetime):
+            value = value.isoformat()
+        self["_session_expiry"] = value
+
+    def get_expire_at_browser_close(self):
+        """
+        Return ``True`` if the session is set to expire when the browser
+        closes, and ``False`` if there's an expiry date. Use
+        ``get_expiry_date()`` or ``get_expiry_age()`` to find the actual expiry
+        date/age, if there is one.
+        """
+        if (expiry := self.get("_session_expiry")) is None:
+            return settings.SESSION_EXPIRE_AT_BROWSER_CLOSE
+        return expiry == 0
+
+    def flush(self):
+        """
+        Remove the current session data from the database and regenerate the
+        key.
+        """
+        self.clear()
+        self.delete()
+        self._session_key = None
+
+    def cycle_key(self):
+        """
+        Create a new session key, while retaining the current session data.
+        """
+        data = self._session
+        key = self.session_key
+        self.create()
+        self._session_cache = data
+        if key:
+            self.delete(key)
+
+    # Methods that child classes must implement.
+
+    def exists(self, session_key):
+        """
+        Return True if the given session_key already exists.
+        """
+        raise NotImplementedError(
+            "subclasses of SessionBase must provide an exists() method"
+        )
+
+    def create(self):
+        """
+        Create a new session instance. Guaranteed to create a new object with
+        a unique key and will have saved the result once (with empty data)
+        before the method returns.
+        """
+        raise NotImplementedError(
+            "subclasses of SessionBase must provide a create() method"
+        )
+
+    def save(self, must_create=False):
+        """
+        Save the session data. If 'must_create' is True, create a new session
+        object (or raise CreateError). Otherwise, only update an existing
+        object and don't create one (raise UpdateError if needed).
+        """
+        raise NotImplementedError(
+            "subclasses of SessionBase must provide a save() method"
+        )
+
+    def delete(self, session_key=None):
+        """
+        Delete the session data under this key. If the key is None, use the
+        current session key value.
+        """
+        raise NotImplementedError(
+            "subclasses of SessionBase must provide a delete() method"
+        )
+
+    def load(self):
+        """
+        Load the session data and return a dictionary.
+        """
+        raise NotImplementedError(
+            "subclasses of SessionBase must provide a load() method"
+        )
+
+    @classmethod
+    def clear_expired(cls):
+        """
+        Remove expired sessions from the session store.
+
+        If this operation isn't possible on a given backend, it should raise
+        NotImplementedError. If it isn't necessary, because the backend has
+        a built-in expiration mechanism, it should be a no-op.
+        """
+        raise NotImplementedError("This backend does not support clear_expired().")

env/lib/python3.8/site-packages/django/contrib/sessions/backends/cache.py

@@ -0,0 +1,85 @@
+from django.conf import settings
+from django.contrib.sessions.backends.base import CreateError, SessionBase, UpdateError
+from django.core.cache import caches
+
+KEY_PREFIX = "django.contrib.sessions.cache"
+
+
+class SessionStore(SessionBase):
+    """
+    A cache-based session store.
+    """
+
+    cache_key_prefix = KEY_PREFIX
+
+    def __init__(self, session_key=None):
+        self._cache = caches[settings.SESSION_CACHE_ALIAS]
+        super().__init__(session_key)
+
+    @property
+    def cache_key(self):
+        return self.cache_key_prefix + self._get_or_create_session_key()
+
+    def load(self):
+        try:
+            session_data = self._cache.get(self.cache_key)
+        except Exception:
+            # Some backends (e.g. memcache) raise an exception on invalid
+            # cache keys. If this happens, reset the session. See #17810.
+            session_data = None
+        if session_data is not None:
+            return session_data
+        self._session_key = None
+        return {}
+
+    def create(self):
+        # Because a cache can fail silently (e.g. memcache), we don't know if
+        # we are failing to create a new session because of a key collision or
+        # because the cache is missing. So we try for a (large) number of times
+        # and then raise an exception. That's the risk you shoulder if using
+        # cache backing.
+        for i in range(10000):
+            self._session_key = self._get_new_session_key()
+            try:
+                self.save(must_create=True)
+            except CreateError:
+                continue
+            self.modified = True
+            return
+        raise RuntimeError(
+            "Unable to create a new session key. "
+            "It is likely that the cache is unavailable."
+        )
+
+    def save(self, must_create=False):
+        if self.session_key is None:
+            return self.create()
+        if must_create:
+            func = self._cache.add
+        elif self._cache.get(self.cache_key) is not None:
+            func = self._cache.set
+        else:
+            raise UpdateError
+        result = func(
+            self.cache_key,
+            self._get_session(no_load=must_create),
+            self.get_expiry_age(),
+        )
+        if must_create and not result:
+            raise CreateError
+
+    def exists(self, session_key):
+        return (
+            bool(session_key) and (self.cache_key_prefix + session_key) in self._cache
+        )
+
+    def delete(self, session_key=None):
+        if session_key is None:
+            if self.session_key is None:
+                return
+            session_key = self.session_key
+        self._cache.delete(self.cache_key_prefix + session_key)
+
+    @classmethod
+    def clear_expired(cls):
+        pass

env/lib/python3.8/site-packages/django/contrib/sessions/backends/cached_db.py

@@ -0,0 +1,72 @@
+"""
+Cached, database-backed sessions.
+"""
+
+from django.conf import settings
+from django.contrib.sessions.backends.db import SessionStore as DBStore
+from django.core.cache import caches
+
+KEY_PREFIX = "django.contrib.sessions.cached_db"
+
+
+class SessionStore(DBStore):
+    """
+    Implement cached, database backed sessions.
+    """
+
+    cache_key_prefix = KEY_PREFIX
+
+    def __init__(self, session_key=None):
+        self._cache = caches[settings.SESSION_CACHE_ALIAS]
+        super().__init__(session_key)
+
+    @property
+    def cache_key(self):
+        return self.cache_key_prefix + self._get_or_create_session_key()
+
+    def load(self):
+        try:
+            data = self._cache.get(self.cache_key)
+        except Exception:
+            # Some backends (e.g. memcache) raise an exception on invalid
+            # cache keys. If this happens, reset the session. See #17810.
+            data = None
+
+        if data is None:
+            s = self._get_session_from_db()
+            if s:
+                data = self.decode(s.session_data)
+                self._cache.set(
+                    self.cache_key, data, self.get_expiry_age(expiry=s.expire_date)
+                )
+            else:
+                data = {}
+        return data
+
+    def exists(self, session_key):
+        return (
+            session_key
+            and (self.cache_key_prefix + session_key) in self._cache
+            or super().exists(session_key)
+        )
+
+    def save(self, must_create=False):
+        super().save(must_create)
+        self._cache.set(self.cache_key, self._session, self.get_expiry_age())
+
+    def delete(self, session_key=None):
+        super().delete(session_key)
+        if session_key is None:
+            if self.session_key is None:
+                return
+            session_key = self.session_key
+        self._cache.delete(self.cache_key_prefix + session_key)
+
+    def flush(self):
+        """
+        Remove the current session data from the database and regenerate the
+        key.
+        """
+        self.clear()
+        self.delete(self.session_key)
+        self._session_key = None

env/lib/python3.8/site-packages/django/contrib/sessions/backends/db.py

@@ -0,0 +1,110 @@
+import logging
+
+from django.contrib.sessions.backends.base import CreateError, SessionBase, UpdateError
+from django.core.exceptions import SuspiciousOperation
+from django.db import DatabaseError, IntegrityError, router, transaction
+from django.utils import timezone
+from django.utils.functional import cached_property
+
+
+class SessionStore(SessionBase):
+    """
+    Implement database session store.
+    """
+
+    def __init__(self, session_key=None):
+        super().__init__(session_key)
+
+    @classmethod
+    def get_model_class(cls):
+        # Avoids a circular import and allows importing SessionStore when
+        # django.contrib.sessions is not in INSTALLED_APPS.
+        from django.contrib.sessions.models import Session
+
+        return Session
+
+    @cached_property
+    def model(self):
+        return self.get_model_class()
+
+    def _get_session_from_db(self):
+        try:
+            return self.model.objects.get(
+                session_key=self.session_key, expire_date__gt=timezone.now()
+            )
+        except (self.model.DoesNotExist, SuspiciousOperation) as e:
+            if isinstance(e, SuspiciousOperation):
+                logger = logging.getLogger("django.security.%s" % e.__class__.__name__)
+                logger.warning(str(e))
+            self._session_key = None
+
+    def load(self):
+        s = self._get_session_from_db()
+        return self.decode(s.session_data) if s else {}
+
+    def exists(self, session_key):
+        return self.model.objects.filter(session_key=session_key).exists()
+
+    def create(self):
+        while True:
+            self._session_key = self._get_new_session_key()
+            try:
+                # Save immediately to ensure we have a unique entry in the
+                # database.
+                self.save(must_create=True)
+            except CreateError:
+                # Key wasn't unique. Try again.
+                continue
+            self.modified = True
+            return
+
+    def create_model_instance(self, data):
+        """
+        Return a new instance of the session model object, which represents the
+        current session state. Intended to be used for saving the session data
+        to the database.
+        """
+        return self.model(
+            session_key=self._get_or_create_session_key(),
+            session_data=self.encode(data),
+            expire_date=self.get_expiry_date(),
+        )
+
+    def save(self, must_create=False):
+        """
+        Save the current session data to the database. If 'must_create' is
+        True, raise a database error if the saving operation doesn't create a
+        new entry (as opposed to possibly updating an existing entry).
+        """
+        if self.session_key is None:
+            return self.create()
+        data = self._get_session(no_load=must_create)
+        obj = self.create_model_instance(data)
+        using = router.db_for_write(self.model, instance=obj)
+        try:
+            with transaction.atomic(using=using):
+                obj.save(
+                    force_insert=must_create, force_update=not must_create, using=using
+                )
+        except IntegrityError:
+            if must_create:
+                raise CreateError
+            raise
+        except DatabaseError:
+            if not must_create:
+                raise UpdateError
+            raise
+
+    def delete(self, session_key=None):
+        if session_key is None:
+            if self.session_key is None:
+                return
+            session_key = self.session_key
+        try:
+            self.model.objects.get(session_key=session_key).delete()
+        except self.model.DoesNotExist:
+            pass
+
+    @classmethod
+    def clear_expired(cls):
+        cls.get_model_class().objects.filter(expire_date__lt=timezone.now()).delete()

env/lib/python3.8/site-packages/django/contrib/sessions/backends/file.py

@@ -0,0 +1,210 @@
+import datetime
+import logging
+import os
+import shutil
+import tempfile
+
+from django.conf import settings
+from django.contrib.sessions.backends.base import (
+    VALID_KEY_CHARS,
+    CreateError,
+    SessionBase,
+    UpdateError,
+)
+from django.contrib.sessions.exceptions import InvalidSessionKey
+from django.core.exceptions import ImproperlyConfigured, SuspiciousOperation
+
+
+class SessionStore(SessionBase):
+    """
+    Implement a file based session store.
+    """
+
+    def __init__(self, session_key=None):
+        self.storage_path = self._get_storage_path()
+        self.file_prefix = settings.SESSION_COOKIE_NAME
+        super().__init__(session_key)
+
+    @classmethod
+    def _get_storage_path(cls):
+        try:
+            return cls._storage_path
+        except AttributeError:
+            storage_path = (
+                getattr(settings, "SESSION_FILE_PATH", None) or tempfile.gettempdir()
+            )
+            # Make sure the storage path is valid.
+            if not os.path.isdir(storage_path):
+                raise ImproperlyConfigured(
+                    "The session storage path %r doesn't exist. Please set your"
+                    " SESSION_FILE_PATH setting to an existing directory in which"
+                    " Django can store session data." % storage_path
+                )
+
+            cls._storage_path = storage_path
+            return storage_path
+
+    def _key_to_file(self, session_key=None):
+        """
+        Get the file associated with this session key.
+        """
+        if session_key is None:
+            session_key = self._get_or_create_session_key()
+
+        # Make sure we're not vulnerable to directory traversal. Session keys
+        # should always be md5s, so they should never contain directory
+        # components.
+        if not set(session_key).issubset(VALID_KEY_CHARS):
+            raise InvalidSessionKey("Invalid characters in session key")
+
+        return os.path.join(self.storage_path, self.file_prefix + session_key)
+
+    def _last_modification(self):
+        """
+        Return the modification time of the file storing the session's content.
+        """
+        modification = os.stat(self._key_to_file()).st_mtime
+        tz = datetime.timezone.utc if settings.USE_TZ else None
+        return datetime.datetime.fromtimestamp(modification, tz=tz)
+
+    def _expiry_date(self, session_data):
+        """
+        Return the expiry time of the file storing the session's content.
+        """
+        return session_data.get("_session_expiry") or (
+            self._last_modification()
+            + datetime.timedelta(seconds=self.get_session_cookie_age())
+        )
+
+    def load(self):
+        session_data = {}
+        try:
+            with open(self._key_to_file(), encoding="ascii") as session_file:
+                file_data = session_file.read()
+            # Don't fail if there is no data in the session file.
+            # We may have opened the empty placeholder file.
+            if file_data:
+                try:
+                    session_data = self.decode(file_data)
+                except (EOFError, SuspiciousOperation) as e:
+                    if isinstance(e, SuspiciousOperation):
+                        logger = logging.getLogger(
+                            "django.security.%s" % e.__class__.__name__
+                        )
+                        logger.warning(str(e))
+                    self.create()
+
+                # Remove expired sessions.
+                expiry_age = self.get_expiry_age(expiry=self._expiry_date(session_data))
+                if expiry_age <= 0:
+                    session_data = {}
+                    self.delete()
+                    self.create()
+        except (OSError, SuspiciousOperation):
+            self._session_key = None
+        return session_data
+
+    def create(self):
+        while True:
+            self._session_key = self._get_new_session_key()
+            try:
+                self.save(must_create=True)
+            except CreateError:
+                continue
+            self.modified = True
+            return
+
+    def save(self, must_create=False):
+        if self.session_key is None:
+            return self.create()
+        # Get the session data now, before we start messing
+        # with the file it is stored within.
+        session_data = self._get_session(no_load=must_create)
+
+        session_file_name = self._key_to_file()
+
+        try:
+            # Make sure the file exists.  If it does not already exist, an
+            # empty placeholder file is created.
+            flags = os.O_WRONLY | getattr(os, "O_BINARY", 0)
+            if must_create:
+                flags |= os.O_EXCL | os.O_CREAT
+            fd = os.open(session_file_name, flags)
+            os.close(fd)
+        except FileNotFoundError:
+            if not must_create:
+                raise UpdateError
+        except FileExistsError:
+            if must_create:
+                raise CreateError
+
+        # Write the session file without interfering with other threads
+        # or processes.  By writing to an atomically generated temporary
+        # file and then using the atomic os.rename() to make the complete
+        # file visible, we avoid having to lock the session file, while
+        # still maintaining its integrity.
+        #
+        # Note: Locking the session file was explored, but rejected in part
+        # because in order to be atomic and cross-platform, it required a
+        # long-lived lock file for each session, doubling the number of
+        # files in the session storage directory at any given time.  This
+        # rename solution is cleaner and avoids any additional overhead
+        # when reading the session data, which is the more common case
+        # unless SESSION_SAVE_EVERY_REQUEST = True.
+        #
+        # See ticket #8616.
+        dir, prefix = os.path.split(session_file_name)
+
+        try:
+            output_file_fd, output_file_name = tempfile.mkstemp(
+                dir=dir, prefix=prefix + "_out_"
+            )
+            renamed = False
+            try:
+                try:
+                    os.write(output_file_fd, self.encode(session_data).encode())
+                finally:
+                    os.close(output_file_fd)
+
+                # This will atomically rename the file (os.rename) if the OS
+                # supports it. Otherwise this will result in a shutil.copy2
+                # and os.unlink (for example on Windows). See #9084.
+                shutil.move(output_file_name, session_file_name)
+                renamed = True
+            finally:
+                if not renamed:
+                    os.unlink(output_file_name)
+        except (EOFError, OSError):
+            pass
+
+    def exists(self, session_key):
+        return os.path.exists(self._key_to_file(session_key))
+
+    def delete(self, session_key=None):
+        if session_key is None:
+            if self.session_key is None:
+                return
+            session_key = self.session_key
+        try:
+            os.unlink(self._key_to_file(session_key))
+        except OSError:
+            pass
+
+    def clean(self):
+        pass
+
+    @classmethod
+    def clear_expired(cls):
+        storage_path = cls._get_storage_path()
+        file_prefix = settings.SESSION_COOKIE_NAME
+
+        for session_file in os.listdir(storage_path):
+            if not session_file.startswith(file_prefix):
+                continue
+            session_key = session_file[len(file_prefix) :]
+            session = cls(session_key)
+            # When an expired session is loaded, its file is removed, and a
+            # new file is immediately created. Prevent this by disabling
+            # the create() method.
+            session.create = lambda: None
+            session.load()

env/lib/python3.8/site-packages/django/contrib/sessions/backends/signed_cookies.py

@@ -0,0 +1,81 @@
+from django.contrib.sessions.backends.base import SessionBase
+from django.core import signing
+
+
+class SessionStore(SessionBase):
+    def load(self):
+        """
+        Load the data from the key itself instead of fetching from some
+        external data store. Opposite of _get_session_key(), raise BadSignature
+        if signature fails.
+        """
+        try:
+            return signing.loads(
+                self.session_key,
+                serializer=self.serializer,
+                # This doesn't handle non-default expiry dates, see #19201
+                max_age=self.get_session_cookie_age(),
+                salt="django.contrib.sessions.backends.signed_cookies",
+            )
+        except Exception:
+            # BadSignature, ValueError, or unpickling exceptions. If any of
+            # these happen, reset the session.
+            self.create()
+        return {}
+
+    def create(self):
+        """
+        To create a new key, set the modified flag so that the cookie is set
+        on the client for the current request.
+        """
+        self.modified = True
+
+    def save(self, must_create=False):
+        """
+        To save, get the session key as a securely signed string and then set
+        the modified flag so that the cookie is set on the client for the
+        current request.
+        """
+        self._session_key = self._get_session_key()
+        self.modified = True
+
+    def exists(self, session_key=None):
+        """
+        This method makes sense when you're talking to a shared resource, but
+        it doesn't matter when you're storing the information in the client's
+        cookie.
+        """
+        return False
+
+    def delete(self, session_key=None):
+        """
+        To delete, clear the session key and the underlying data structure
+        and set the modified flag so that the cookie is set on the client for
+        the current request.
+        """
+        self._session_key = ""
+        self._session_cache = {}
+        self.modified = True
+
+    def cycle_key(self):
+        """
+        Keep the same data but with a new key. Call save() and it will
+        automatically save a cookie with a new key at the end of the request.
+        """
+        self.save()
+
+    def _get_session_key(self):
+        """
+        Instead of generating a random string, generate a secure url-safe
+        base64-encoded string of data as our session key.
+        """
+        return signing.dumps(
+            self._session,
+            compress=True,
+            salt="django.contrib.sessions.backends.signed_cookies",
+            serializer=self.serializer,
+        )
+
+    @classmethod
+    def clear_expired(cls):
+        pass