Is there a way to not encrypt the cookie set by SessionMiddleware?

[RafayAK]

Hi, this may be a naive question, but I'm trying to debug some code and would love to see the key-value pairs being set in the browser by SessionMiddleware unencrypted. Is there a way to do that?

Using secret_key=None as below does not work and still encrypts the session cookie

app.add_middleware(SessionMiddleware, secret_key=None, https_only=True)

[jhominal]

By setting secret_key to None, what ended up happening is that the SessionMiddleware casts secret_key to a str, meaning that you end up with using the "None" string as the secret key.

However, note that session data is available both on the ASGI scope object (under the "session" key) and as a session property on Request objects.

That is, it would be pretty easy for you to add a (debug) endpoint that returns content of the session cookie:

async def view_decrypted_session(request: starlette.requests.Request) -> starlette.responses.Response:
    return starlette.responses.JSONResponse(request.session)

[RafayAK]

yep, I ended up just logging the value for dev purposes in my backend.