Struct biscotti::config::CryptoRule

pub struct CryptoRule {
    pub cookie_names: Vec<String>,
    pub type: CryptoType,
    pub key: Key,
    pub secondary_keys: Vec<Key>,
}

CryptoRule specifies whether certain cookies should be encrypted or signed.

Fields

cookie_names: Vec<String>

The names of the cookies to which this rule applies.

type: CryptoType

How the cookies should be secured: either encryption or signing.

key: Key

The key to use for encryption or signing.

Requirements

The key must be at least 64 bytes long and should be generated using a cryptographically secure random number generator.

secondary_keys: Vec<Key>

Secondary keys are used to decrypt/verify request cookies that failed to be decrypted/verified using the primary key.
Secondary keys are never used to encrypt/sign response cookies.

Key rotation

Secondary keys exist to enable key rotation.
From time to time, you may want to change the key used to sign or encrypt cookies.
If you do this naively (i.e. change CryptoRule::key to a new value), the server
will immediately start rejecting all existing cookies because they were signed/encrypted with the old key.

Using secondary keys, you can start using the new key without invalidating all existing cookies. The process is as follows:

1. Generate a new key
2. Set key to the new key, and add the old key to the secondary_keys vector
3. Wait for the expiration of all cookies signed/encrypted with the old key
4. Remove the old key from the secondary_keys vector

Trait Implementations

impl Clone for CryptoRule

fn clone(&self) -> CryptoRule

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CryptoRule

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for CryptoRule

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.