<br><br><div><span class="gmail_quote"><b class="gmail_sendername">Dave Bauer</b> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<br><br>On OpenACS (ancient web toolkit) there is a pool of secret tokens that<br>are generated by the server. These are used to digitally sign the<br>values in the cookies. Note, the values are not secure unless you use<br>
HTTPS in this scheme. You can make a cookie "secure" and it will<br>always be transmitted over HTTPs. Of course the values are on the<br>computer, that's why you shouldn't put anything secret IN the cookie.
<br>You could also use someting like ssha-1 to encode the values before<br>setting the cookie.<br><br>Here's the code where I am getting the design ideas from if you are<br>interested. it is written in Tcl but should be reasonbly readable.
<br><br><a href="http://cvs.openacs.org/cvs/openacs-4/packages/acs-tcl/tcl/security-procs.tcl?rev=1.44&view=markup">http://cvs.openacs.org/cvs/openacs-4/packages/acs-tcl/tcl/security-procs.tcl?rev=1.44&view=markup
</a><br><br>Good luck.</blockquote><div><br>Thanks a lot Dave, I'll have a look of it asap!<br>
Leandro </div><br></div><br>