mozilla/mod_authn_persona — pull request #23 by gozer-mozilla (2013-09-10 01:10:26+00:00)
Title: HMAC/SHA1 implementation

Looking at the implementation of the signature method, I noticed it's not doing a proper HMAC, but instead, using a more simplistic SHA1(secret + data) which is known to be flawed and insecure.

This branch is a reimplemntation of the cookie signature scheme that uses the standard secure HMAC method.

It's functionally identical and is spec verified AFAIKT