Re: Cookie not signed after upgrading mojolicious

[Corion]

I don't see a Mojolicious 9.30, but the Changes file mentions:

Swiched from HMAC-SHA1 to HMAC-SHA256 for signed cookies. Note that this means that all sessions will be reset.

To me, this means this is expected behaviour. I don't know if/how you can migrate the signed cookies from the old version to the new version automatically. I guess you would need to have two code paths. One that receives and validates the HMAC-SHA256 cookies, and one that gets taken when the SHA256 validation fails (maybe copied from the old Mojolicious distribution), that validates against the old HMAC-SHA1, and does an upgrade.

[newperldeveloper]

Didn't see this information, I didn't see that information. Is there a way to have plack switch to signing with HMAC-SHA256.

[Corion]

Plack itself doesn't handle sessions, and I don't find Plack::Session::Store::File::Mojolicious on CPAN (neither does Google find it elsewhere), so I don't know what you would need to do to make it sign the cookies using HMAC-SHA256. Maybe that file is just the Mojolicious code for cookie signing copied into the Plack API and you can also just copy the (new) Mojolicious code into that.

[newperldeveloper]

The new mojolicous code is the same, i did pass in httponly=>1,secret=>'whatever the secret is' and that started at least I think gave me an incorrect signatue error. I say think because i made a lot of changes. But the error it gave was cookie has bad signature