> Using a secret to sign or encrypt a cookie does normally work If the secret key is not compromised. So you have to ask yourself - why you send to the user so

> Using a secret to sign or encrypt a cookie does normally work If the secret key is not compromised. So you have to ask yourself - why you send to the user some info that is so sensitive that needs signing? Why not just keep this info to yourself and send an opaque ID instead? Yes, I know there are issues with it too, but at least this issue is not there. > 3 as well I think is unfair. That isn't something facebook implemented I didn't say it's Facebook fault - though ultimately, of course, it is as much as if you run certain software on your servers and do not configure it properly, it's your fault. So there's a fail in having security key in a place that's so easily accessible that debug mode dumps it without even asking. Not necessarily a direct Facebook fail, but a fail.