Struct CookieSealer 

pub struct CookieSealer {
    key_bytes: [u8; 32],
    rng: SystemRandom,
}

Seals and opens encrypted session cookies with a fixed derived key.

Fields

key_bytes: [u8; 32]

rng: SystemRandom

Implementations

impl CookieSealer

pub fn new(secret: &str) -> Self

Derives the AES-256 key from secret (SHA-256), so any-length secrets work. The same secret must be configured on every gateway instance.

fn key(&self) -> LessSafeKey

pub fn seal(&self, payload: &[u8], ttl: Duration) -> String

Seals payload into a cookie value that expires after ttl.

Layout of the returned base64url string: nonce(12) || AES-256-GCM(expiry_be_u64(8) || payload). The expiry is authenticated, so an attacker cannot extend a session.

pub fn open(&self, value: &str) -> Result<Vec<u8>, CookieError>

Opens a sealed cookie value, returning the original payload.

Fails with CookieError if the value is malformed, authentication fails (wrong key or tampering), or the embedded expiry has passed.