encrypt cookies

[defunctzombie]

Signing is nice, but a better thing might be to just encrypt the cookies outright. This serves the purpose of signing and also hiding the session details from user inspection.

[jonathanong]

Meh I don't think it's really necessary. Makes it a little harder to debug. and at that point you might as well use a session store if you want to hide details from the user

[defunctzombie]

Another module I will make then ;) security requirements are different for
different apps.
On May 6, 2014 11:39 PM, "Jonathan Ong" notifications@github.com wrote:

Meh I don't think it's really necessary. Makes it a little harder to
debug. and at that point you might as well use a session store if you want
to hide details from the user

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/9#issuecomment-42394243
.

[Fishrock123]

Can this be done via an option?

[jonathanong]

i asked @jed if he wants to move his stuff here. i'm not sure if i do this in this repo, but in koa's session, i began base64 encoding the entire session anyways to avoid issues with cookies with ;s and stuff. i think base64 encoding cookies or encrypting them are good options for a cookies lib.

[Fishrock123]

Re @defunctzombie: I would rather not have 2 libs for virtually the same thing.

[defunctzombie]

I agree. I would prefer to stop using my older yummy module in favor of
this one. Maybe I will make a PR with encryption so we have something more
tangible to work with.
On May 7, 2014 11:53 AM, "Jeremiah Senkpiel" notifications@github.com
wrote:

Re @defunctzombie https://github.com/defunctzombie: I would rather not
have 2 libs for virtually the same thing.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/9#issuecomment-42467835
.

[nburoojy]

FYI, I kind of hacked encryption onto this package. Let me know if you want me to clean up, test and merge my fork: https://github.com/civitaslearning/cookie-session.

[coen-hyde]

@nburoojy Can your encryption implementation be merged back into cookie-session?

[gabeio]

@coen-hyde he said it was a fork so it should be possible...

[sankethkatta]

Mozilla has a package which does just this: mozilla/node-client-sessions

[dougwilson]

Hi @sankethkatta , yep, and it's a 100% valid alternative! npm gives you a lot of choice :)

[ebourmalo]

I was also looking for this option and didn't find anything. I made a super-easy to use express middleware to achieve transparently cookie encryption / decryption: cookie-encrypter.

var app = express();
app.use(cookieParser(secretKey));
app.use(cookieEncrypter(secretKey));

Hope this helps

[btxtiger]

@ebourmalo did you get it working with cookie-session? It seems the session cookies were not caught by the middleware.

[dougwilson]

So apparently having stale issues is a sign of bad modules these days, who knew. This is still a desired feature that I plan to work on at some point, though anyone is welcome to make a PR as well. I'm going to close this issue, unfortunately, as just having it open down ranks the module.

[sawyerh]

@dougwilson Just confirming I'm not overlooking something: encryption support hasn't been added to cookie-session? Could this request be reopened if so?

[dougwilson]

It has not been added and as noted above I'm not going to reopen the issue, either, for those reasons. If you want to see it happen, the best thing to do is to put to together a pull request instead of us keeping an issue open indefinitely. Perhaps if someone committed to having a pull request made in a specific timeline I can open this issue. If you want to make that commitment, let me know and I can reopen.

[btxtiger]

@dougwilson
You can check out my node module, if it fits to your requirements.
https://github.com/btxtiger/encrypt-cookie

[mircohacker]

@dougwilson my PR for this feature is ready. Please have a look.