Rack session handling middleware that serializes the session data into an encrypted cookie; that's also async-aware.

This is probably not the most secure solution, but it's better than storing your session data in a cookie as clear text. That being said, it's much more secure to use a pre-generated key with this module than a password-derived key, but the latter is provided as a convenience option.

If you have strict security requirements, you really shouldn't be storing sensitive data in the session.

This software is licensed under the Simplified BSD License as described in the LICENSE file.

• rack

gem install rack-session-encryptedcookie

Just add something like this to your config.ru:

require 'rack/session/encryptedcookie'

use Rack::Session::EncryptedCookie, domain: 'domain.name', salt: 'salthere', key: 'my_secret'

... and you can access the session hash via env['rack.session'] per usual.

The full list of options is:

You can generate a key using something like:

SecureRandom.random_bytes(key_size_in_bytes)

or anything else, as long as the key is the proper size for the cipher.

To use a pre-generated key, you must specify the following options:

cipher: 'aes-256-cbc', # The cipher algorithm to use (defaults to aes-256-cbc)
key:    your_key_here, # Your pre-generated key

Examples:

# Using the default cipher
use Rack::Session::EncryptedCookie, key: your_key

# Using the specified cipher
use Rack::Session::EncryptedCookie, cipher: your_cipher, key: your_key

You can derive a key by specifying the following options:

cipher  'aes-256-cbc', # The cipher algorithm to use (default aes-256-cbc)
salt    'salthere',    # Salt to use for key generation
rounds: 2000,          # Number of cipher rounds for key generation (default: 2000)
key:    'yoursecret',  # A password from which to generate the key

crypto_key and salt must be specified in order to enable encryption. All other options have defaults available.

Example:

use Rack::Session::EncryptedCookie, salt: 'salthere', crypto_key: 'my_secret'