class Rack::Protection::EncryptedCookie

Rack::Protection::EncryptedCookie provides simple cookie based session management. By default, the session is a Ruby Hash stored as base64 encoded marshalled data set to :key (default: rack.session). The object that encodes the session data is configurable and must respond to encode and decode. Both methods must take a string and return a string.

When the secret key is set, cookie data is checked for data integrity. The old_secret key is also accepted and allows graceful secret rotation. A legacy_hmac_secret is also accepted and is used to upgrade existing sessions to the new encryption scheme.

There is also a legacy_hmac_coder option which can be set if a non-default coder was used for legacy session cookies.

Example:

use Rack::Protection::EncryptedCookie,
                           :key => 'rack.session',
                           :domain => 'foo.com',
                           :path => '/',
                           :expire_after => 2592000,
                           :secret => 'change_me',
                           :old_secret => 'old_secret'

All parameters are optional.

Example using legacy HMAC options

Rack::Protection:EncryptedCookie.new(application, {
  # The secret used for legacy HMAC cookies
  legacy_hmac_secret: 'legacy secret',
  # legacy_hmac_coder will default to Rack::Protection::EncryptedCookie::Base64::Marshal
  legacy_hmac_coder: Rack::Protection::EncryptedCookie::Identity.new,
  # legacy_hmac will default to OpenSSL::Digest::SHA1
  legacy_hmac: OpenSSL::Digest::SHA256
})

Example of a cookie with no encoding:

Rack::Protection::EncryptedCookie.new(application, {
  :coder => Rack::Protection::EncryptedCookie::Identity.new
})

Example of a cookie with custom encoding:

Rack::Protection::EncryptedCookie.new(application, {
  :coder => Class.new {
    def encode(str); str.reverse; end
    def decode(str); str.reverse; end
  }.new
})