FooBarWidget/encrypted_cookie_store — pull request #3 by ccutrer (2012-05-11 18:09:47+00:00)
Title: Improvements!

* don't bother encrypting the IV (?!)
* use the same encryption key for the encryption as for the HMAC
(easy to configure, since it's the same as for normal CookieStore)
* compress the session before encrypting it (optional, will skip
compression if it actually makes it larger)
* use AES 128 CBC (AES 256 is actually *weaker*, due to a known
attack on it), which also reduces the cookie size due to a smaller
IV and less padding
* use URI-safe base64 encoding to not waste space percent-encoding
characters in the cookie
* use . as the separator between cookie fields (instead of -, which
is now a part of the base64 encoding)
* if :expire_after is provided, add a timestamp to the cookie that's
included in the HMAC to allow for secure expiration of cookies
(preventing session replay attacks after the expiration of the
cookie)
* don't re-set the cookie on every request if the session hasn't
changed (unless :expire_after is in use, in which case do it every
5 minutes by default in order to refresh the timestamp)