cookie-encrypter

cookie-encrypter copied to clipboard

The Readme says `secret` can be "a string or array used for encrypting cookies.". But the code doesn't handle arrays so fails here: ``` if (algorithm === 'aes256' && key.length...

philipbeber

Security warning: Replay attack possible

1

If I am not completely mistaken the encryption lacks a proper randomization and therefore is susceptible to a replay attack. Who would prevent an attacker from intercepting an encrypted cookie...

clecap

In order to reduce the number of bytes used in the cookie, I had to use a different encoding. Maybe other people have similar issues when the cookie content grows...

nexx512

# cookie-encrypter Vulnerability Let's imagine a website with the following source code: ```js const express = require('express'); const cookieParser = require('cookie-parser'); const cookieEncrypter = require('cookie-encrypter'); const app = express(); app.use(cookieParser("NicePasswordHereItIsAGoodSecret!"));...

mathysEthical