3 ms·
The key isn't sent to the client. You can set the flash message in plain text, but I'd rather avoid the possibility of tampering, and it lets me reuse the same
by kevinburke 10y ago
The key isn't sent to the client.
You can set the flash message in plain text, but I'd rather avoid the possibility of tampering, and it lets me reuse the same cookie code I use to encrypt e.g. session tokens.
- deleted 10y ago[deleted]
- slrz 10y agoWhat kind of tampering are you thinking about here? Aren't those messages sent from the server to the client? Thus, in-transit tampering should be prevented by TLS. If the key isn't sent to the client, how is the client supposed to display that message? Why are these messages encoded into a cookie in the first place? I don't think I understand the concept.
- kevinburke 10y agoThe message is read on the server as part of the next request and then displayed in the appropriate spot in thr UI