On 3/17/07, Brad Ediger <[EMAIL PROTECTED]> wrote: > The CookieStore takes great care to provide integrity of session data, but > we seem to have lost confidentiality in the process. The server-side storage > methods had the implicit advantage of keeping the session data secret, but I > don't know if this was intentional or just an unintended consequence.
My first cut used symmetric encryption. It's a bit slower than HMAC, but both push thousands of ops/sec on my laptop so it's not really a concern. The typical session stores a handful of utilitarian info: a user_id, a flash message, and perhaps a return URL. You shouldn't, and needn't, use the session for confidential data. I consider exposing these data (however obfuscated) as statement of the reasonable bounds of session usage. > Would anyone see a disadvantage to symmetrically encrypting the cookie data > rather than signing it with an HMAC? There isn't much technical disadvantage, though it loses HMAC's in-the-clear philosophical advantage. However, the cookie store is built to be easily subclassed; please do investigate! jeremy --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "Ruby on Rails: Core" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/rubyonrails-core?hl=en -~----------~----~----~----~------~----~------~--~---
