Encrypt and sign session cookies

[SergioBenitez]

No description provided.

[SergioBenitez]

This is currently blocked on an open PR for Hyper updating its OpenSSL to 0.9 and the Cookies lib to 0.4. Pushing to 0.2.

[flosse]

I really hope hyperium/hyper#975 will be merged soon :)

[mgattozzi]

Should be noted it might not be based off the response from the maintainer here:
hyperium/hyper#985

Seems like it'll remove openssl-sys so as to not cause conflicts/not be breaking change.

[SergioBenitez]

rwf2/cookie-rs#68 will make this possible.

[SergioBenitez]

Unfortunately this must be pushed to 0.3.

[flosse]

Seems like it'll remove openssl-sys so as to not cause conflicts/not be breaking change.

It's done in v0.10.0 :)

[SergioBenitez]

I've submitted a PR (rwf2/cookie-rs#76) to make this possible. After the PR is in, session support in Rocket should be straightforward.

[majkcramer]

After the PR is in, session support in Rocket should be straightforward.

PR is in.

[SergioBenitez]

Sessions landed in master ~18 days ago in 16cb729. Aside from the session example, however, sessions are undocumented. This is because the API is likely to change before support lands in 0.3. I'm hoping for a more robust, future-proof solution. That route, however, requires a few more general features to implement.

[pointlessone]

Session can not be restored after process restart. It appears, some key gets changed on every run and it prevents session from properly decrypting cookies.

I'm not sure if this is a bug or me using it wrong. Also if it needs its own issue here.

[SergioBenitez]

@pointlessone You need to set the secret_key config parameter. Otherwise, Rocket will generate a secret key for you.