Q:

Cookie is changed on every request, using sinatra and Rack::Session::EncryptedCookie

I'm new to web app development & have just started learning Sinatra framework. I'm currently developing a login system.
Here's the necessary code :
require 'sinatra'
require 'openssl'
require 'encrypted_cookie'

configure do
  use Rack::Session::EncryptedCookie, :secret => "foo-bar-baz", :httponly => true

Then, I'm storing username in the session if he/she is authorized :
post '/' do
  if authorize(params[:name], params[:password], params[:csrfkey])
    session[:name] = params[:name]
  end
end

The cookie is encrypted all right. And it is also remembering session values.
But while using Firebug I noticed that at every request(page load, refresh, etc) the cookie's content is changed & I mean completely changed. It seems like Sinatra is sending new cookie at every request.
Previously, I was using enable :sessions & the cookie never changed.
So my questions are, is it normal to have cookie's content changed at every request while in a session?
Is it happening because it is encrypted?
I searched high & low on the net but no one has got this problem I guess..

A:

The source for encrypted_cookie shows that it generates different encrypted output every time it is called regardless of the input. There are 2 reasons for this:

The library would have to know what the session value was during the last request. It doesn't, all it does is accept a single input, the given session. If you wished to circumvent this and just rewrite the cookie (I suppose) you could, since you have the extra information available higher up in the Sinatra app.
It's more secure. It doesn't leak information (if the cookie doesn't change then an observer of the cookie knows nothing changed during the request), and it gives an attacker less time to try and get to a meaningful value.

