senchalabs/connect — Issue #492: encrypt cookie sessions versus signing
Author: shtylman
Created: 2012-02-28 17:07:09+00:00
State: open

Something I have done in my own cookie session middleware is to encrypt the cookie value versus signing. The primary reason for this was to prevent the end user from seeing the session data. It has the added benefit of also verifying the cookie data (no longer needing a specific signature).

Thoughts on changing the connect middleware to do this instead? It seems like a more sensible default to me but maybe other web frameworks don't take this approach. Certainly anyone is free to write their own middleware as I did :)

I am happy to do a pull request with how I implemented it if this is something worth entertaining further.