PlugRailsCookieSessionStore.MessageEncryptor (plug_rails_cookie_session_store v2.0.0)
MessageEncryptor
is a simple way to encrypt values which get stored
somewhere you don't trust.
The cipher text and initialization vector are base64 encoded and
returned to you.
This can be used in situations similar to the MessageVerifier
, but where
you don't want users to be able to determine the value of the payload.
Example
secret_key_base = "072d1e0157c008193fe48a670cce031faa4e..."
encrypted_cookie_salt = "encrypted cookie"
encrypted_signed_cookie_salt = "signed encrypted cookie"
secret = KeyGenerator.generate(secret_key_base, encrypted_cookie_salt)
sign_secret = KeyGenerator.generate(secret_key_base, encrypted_signed_cookie_salt)
encryptor = MessageEncryptor.new(secret, sign_secret)
data = %{current_user: %{name: "José"}}
encrypted = MessageEncryptor.encrypt_and_sign(encryptor, data)
decrypted = MessageEncryptor.verify_and_decrypt(encryptor, encrypted)
decrypted.current_user.name # => "José"
Link to this section Summary
Functions
Encrypts and signs a message.
Decrypts and verifies a message. We need to verify the message in order to avoid padding attacks. Reference: http://www.limited-entropy.com/padding-oracle-attacks
Link to this section Functions
Link to this function
encrypt_and_sign(message, secret, sign_secret, cipher \\ :aes_256_cbc)
Encrypts and signs a message.
Link to this function
verify_and_decrypt(encrypted, secret, sign_secret, cipher \\ :aes_256_cbc)
Decrypts and verifies a message. We need to verify the message in order to avoid padding attacks. Reference: http://www.limited-entropy.com/padding-oracle-attacks