iron-graveyard / cookie Goto Github PK

I've started working on getting this crate compiling on the current nightly version.

You can see this work here: https://github.com/andrewbrinker/cookie/tree/refactor/compile-on-nightly

@zzmp

Alloy moved to Request::alloy
Request::url is now a Url struct from https://github.com/servo/rust-url
Moved entirely to Cargo, other PR should pass at some point.

See:

#21
DaGenix/rust-crypto#90

Hello.

I'm trying to use it in your project, but does not compile:

http://joxi.ru/8An5Q4gTaYDP2O

Although cookie signing is supported, I don't see a way to figure out if a cookie value is actually trusted and authenticated. For example, the count example has signing enabled, and it works as expected when a bad signature is detected:

# Bad signature on cookie.
[veeti@veeti-pc examples]$ http localhost:3000 'Cookie: count=s:9999.asd'
Hit Counter: 1

But what happens when you don't include a signature at all?

[veeti@veeti-pc examples]$ http localhost:3000 'Cookie: count=9999'
Hit Counter: 10000

Most frameworks and libraries seem to provide separate collections for regular and signed/secure cookies. Perhaps the same should be done here.

It would be a good idea to sign the key of the cookie (so that you can't use a value signed for key A with key B), and possibly the max age/expiration of the cookie (and then validate that it hasn't passed).