Secure the cookies

[chevett]

was salted cookies

[samandmoore]

gonna salt the cookies?

[samandmoore]

OH I GET IT. har.

store them with a salt so that they are safer in redis and can really only be read back out if you have the salt. duh.

[chevett]

Oh, I would have written a description if I knew you reading this!! But yeah, exactly, that's the plan.

[samandmoore]

nice. I was thinking to myself, "oh dear we're storing auth cookies and stuff in redis, sounds insecure." then you're all like, "of course I realized that, gonna salt them."

[chevett]

Wait not a salt... just encrypted. The key will be in a cooke in the user's browser and never stored. Can't decrypt the cookies in redis without the key from a real cookie. Yeah, that's it.

[samandmoore]

yeahhh that makes more sense. bam. solid impl. now we basically reimplemented a browser.