Golang:crypto Sign Cookie for security

This is a creation in Article, where the information may have evolved or changed.

You can improve the security of your Go Web application by cryptographically signing cookies using Sugarcookie. A small library used to for signing cookie values the can verify and trust on a user ' s return visit. This gives your strong trust and allows you to decouple the cookie from a session on a specific server.

The signed cookie consists of a secret value, a timestamp, and a unique identifier; Which is one-way hashed, then concatenated with the Timestam and unique identifer. Then everything was Base64 encoded making it suitable for storing in a cookie.

hash := sha256.Sum256([]byte(secret + strconv.FormatInt(t, 10) + uniqueUserId))value := hex.EncodeToString(hash[:]) + "-" + strconv.FormatInt(t, 10) + "-" + uniqueUserIdsignature := base64.StdEncoding.EncodeToString([]byte(value))

You verify the cookies are valid by replaying the hashes with the secret and the supplied timestamp and unique ID.

Including the time as part of the hash means you can use it as a secondary mechanism to invalidate the cookie. If It's too old, maybe an half a hour, you know it's no longer good, no need to test it; Just invalidate it.