shtylman/node-yummy — pull request #1 by benatkin (2012-07-13 03:55:27+00:00)
Title: Sign and encrypt

What do you think about signing in addition to encryption? If the encryption secret was somehow cracked (unlikely) at least the user couldn't pass off their own data as session data, without also finding the signing secret. I want this mainly to handle an argument I might get about whether an encrypting cookie library is as robust as a signing cookie library.