# CookieSession Encryption

**URL:** <https://www.ruby-forum.com/t/cookiesession-encryption/123607>\
**Category:** Rails\
**Created:** [December 19, 2007, 3:25am UTC](https://www.ruby-forum.com/t/cookiesession-encryption/123607 "2007-12-19T03:25:48Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![tekwiz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/dfb087/32.png) [@tekwiz](https://www.ruby-forum.com/u/tekwiz)\
**Post date:** [December 19, 2007, 3:25am UTC](https://www.ruby-forum.com/t/cookiesession-encryption/123607/1 "2007-12-19T03:25:48Z")

</div>

I understand that the new CookieSessions use encryption to secure the  
data inside the cookie. The +secret+ that is default defined in  
config.action\_controller.session in the environment.rb appears to be a  
hexidemical key. A few questions regarding this:

1. Is the +secret+ converted from a hex string to a binary key?
2. Can I use any characters in the key
3. What key lengths can I use?

Also, a couple questions about the encryption algorithm:

1. What encryption algorithm is used.
2. What mode is the encryption algorithm operating in (eg. CBC,  
stream, etc.)

One final question: Is the CookieSession attached to the user’s IP  
address in any way within the ActionController, or is this left to the  
developer? (To prevent against a replay attack)

–  
Travis

---

<div class="post-metadata">

**Author:** ![tekwiz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/dfb087/32.png) [@tekwiz](https://www.ruby-forum.com/u/tekwiz)\
**Post date:** [December 19, 2007, 5:56am UTC](https://www.ruby-forum.com/t/cookiesession-encryption/123607/2 "2007-12-19T05:56:47Z")

</div>

On 12/18/07, tekwiz [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> I understand that the new CookieSessions use encryption to secure the  
> data inside the cookie. The +secret+ that is default defined in  
> config.action\_controller.session in the environment.rb appears to be a  
> hexidemical key. A few questions regarding this:
> 
> 1. Is the +secret+ converted from a hex string to a binary key?

no

> 1. Can I use any characters in the key

yes

> 1. What key lengths can I use?

anything 30 bytes or longer

> Also, a couple questions about the encryption algorithm:
> 
> 1. What encryption algorithm is used.
> 2. What mode is the encryption algorithm operating in (eg. CBC,  
> stream, etc.)

The cookie is signed with a message digest. It is not encrypted.

The default is HMAC-SHA1 but you can choose any OpenSSL-supported hash  
you like.

> One final question: Is the CookieSession attached to the user’s IP  
> address in any way within the ActionController, or is this left to the  
> developer? (To prevent against a replay attack)

It’s up to you.

jeremy

---

<div class="post-metadata">

**Author:** ![tekwiz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/dfb087/32.png) [@tekwiz](https://www.ruby-forum.com/u/tekwiz)\
**Post date:** [December 19, 2007, 7:32am UTC](https://www.ruby-forum.com/t/cookiesession-encryption/123607/3 "2007-12-19T07:32:01Z")

</div>

Thank, you. I believe I understand now, but correct me if I’m wrong.

The cookie data is not encrypted at all. It is always in plaintext.  
However, the cookie data is hashed with the secret (aka. a salt) and  
that is also in the cookie for verification upon the next request.

---

<div class="post-metadata">

**Author:** ![tekwiz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/dfb087/32.png) [@tekwiz](https://www.ruby-forum.com/u/tekwiz)\
**Post date:** [December 19, 2007, 8:19pm UTC](https://www.ruby-forum.com/t/cookiesession-encryption/123607/4 "2007-12-19T20:19:00Z")

</div>

On 12/18/07, tekwiz [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Thank, you. I believe I understand now, but correct me if I’m wrong.
> 
> The cookie data is not encrypted at all. It is always in plaintext.  
> However, the cookie data is hashed with the secret (aka. a salt) and  
> that is also in the cookie for verification upon the next request.

Yes. Though we use a message digest (HMAC-SHA1) not a simple hash with  
salt.

jeremy

---

<div class="post-metadata">

**Author:** ![tekwiz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/dfb087/32.png) [@tekwiz](https://www.ruby-forum.com/u/tekwiz)\
**Post date:** [December 19, 2007, 9:39pm UTC](https://www.ruby-forum.com/t/cookiesession-encryption/123607/5 "2007-12-19T21:39:53Z")

</div>

On Dec 19, 2007, at 7:31 AM, tekwiz wrote:

> Thank, you. I believe I understand now, but correct me if I’m wrong.
> 
> The cookie data is not encrypted at all. It is always in plaintext.

Just in case: if you ask whether the data is right there as usual it  
is not because it is encoded in Base64. There’s no encryption, the  
data is readable, and you decode it if you want to see it.

– fxn