<commit_before>## Encrypted session cookies for Rack (and therefore Sinatra)

The `encrypted_cookie` gem provides 128-bit-AES-encrypted, tamper-proof cookies
for Rack through the class `Rack::Session::EncryptedCookie`.

## How to use encrypted\_cookie

    $ gem install encrypted_cookie

Sinatra example:

    require 'sinatra'
    require 'encrypted_cookie'
    
    use Rack::Session::EncryptedCookie,
      :secret => TYPE_YOUR_LONG_RANDOM_STRING_HERE*
    
    get '/' do
      session[:foo] = 'bar'
      "session: " + session.inspect
    end

_*_ Your `:secret` must be at least 16 bytes long and should be really random.

## Encryption and integrity protection

The cookie encryption method is 128-bit AES (with salt). Additionally, the
cookies are integrity protected with Rack's built-in HMAC support, which means
that if a user tampers with their cookie in any way, their session will
immediately be reset to `{}` (empty hash).

## Generating a good secret

    require 'openssl'
    puts OpenSSL::Random.random_bytes(16).inspect<commit_msg>more specific secret generation instructions<commit_after>## Encrypted session cookies for Rack (and therefore Sinatra)

The `encrypted_cookie` gem provides 128-bit-AES-encrypted, tamper-proof cookies
for Rack through the class `Rack::Session::EncryptedCookie`.

## How to use encrypted\_cookie

    $ gem install encrypted_cookie

Sinatra example:

    require 'sinatra'
    require 'encrypted_cookie'
    
    use Rack::Session::EncryptedCookie,
      :secret => TYPE_YOUR_LONG_RANDOM_STRING_HERE*
    
    get '/' do
      session[:foo] = 'bar'
      "session: " + session.inspect
    end

_*_ Your `:secret` must be at least 16 bytes long and should be really random.

## Encryption and integrity protection

The cookie encryption method is 128-bit AES (with salt). Additionally, the
cookies are integrity protected with Rack's built-in HMAC support, which means
that if a user tampers with their cookie in any way, their session will
immediately be reset to `{}` (empty hash).

## Generating a good secret

Run this in a terminal and paste the output into your script:

    $ ruby -ropenssl -e "puts OpenSSL::Random.random_bytes(16).inspect"
{'fraction_non_alphanumeric': 0.08007279344858963, 'fraction_numerical': 0.009099181073703366, 'mean_word_length': 4.043577981651376, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5140255', 'n_tokens_mistral': 659, 'n_tokens_neox': 619, 'n_words': 244}