Many web frameworks like Rails allow you to easily fully encrypt (make unreadable to browser) or sign (make readable but not editable) with a server-side key. S

Many web frameworks like Rails allow you to easily fully encrypt (make unreadable to browser) or sign (make readable but not editable) with a server-side key. Some pen testers will report unsigned or unencrypted cookies so I imagine its quite common.