Sign it as well! For instance: https://github.com/gorilla/securecookie https://github.com/gorilla/securecookie Unless I'm missing something and the payload is

Sign it as well! For instance: https://github.com/gorilla/securecookie https://github.com/gorilla/securecookie Unless I'm missing something and the payload is effectively signed. Either way, I still like to have signing generically done at this level of abstraction. Then I can put whatever in there. Sometimes the encrypted payload is also signed too - maybe with a per-user secret. Now "log out everywhere" is as simple as scrambling the user's secret, thus invalidating their cookies. Simple.