Expand description
Authenticated encryption for anything the application hands to a client.
AES-256-GCM, which is authenticated encryption: decryption verifies a tag over the ciphertext before returning a single byte of plaintext. That matters more than confidentiality here — an encrypted cookie that could be edited by its holder would be worse than no cookie at all, because the application would trust the forgery.
A payload is a self-describing string: base64url of
version(1) || nonce(12) || ciphertext || tag(16). Nothing but the key is
needed to read it back, the version byte leaves room to change cipher later
without invalidating what is already in people’s browsers, and the URL-safe
alphabet means the result drops into a cookie or a query string untouched.
Structs§
- Encrypter
- Encrypts and decrypts with the application key.