On Mar 7, 2006, at 7:07 PM, Titus Brown wrote:
> Signing the cookie is irrelevant as long as the cookie is randomly
> generated from a large space, to defeat attempts at randomly
> duplicating
> it.  It's only important if the cookie contains meaningful data.
>
> Some protection that Quixote used to have is tying a cookie to a
> specific IP address.  That's about as secure as you're going to get.

I'm with Titus on this.

In addition, you can restrict all cookie transport to secure
connections,
and use "secure" and non-persistent cookies,  You can "burn"
any cookies you receive on non-secure connections and also burn
cookies that don't come from the original ip address.

If you are sending cookies in the clear, your session can be hijacked.
I don't think applying encryption or encoding algorithms can have
any impact on this.     At best, it can provide a way to preserve some
session data that you don't want the client to change, without actually
storing it yourself on the server.  At worst, this strategy makes
people think they have security that they do not.