purpose of encryption of session data is exposed in plain text about svelte-kit-cookie-session HOT 5 CLOSED

I'm using prisma and only storing the sessionId in the cookie. I can probably share some best practices in the future, currently working something out.

from svelte-kit-cookie-session.

Hm good question, i think it should be safe to expose these values but i'm in no means a security expert. What you can do is to only expose the data you need on the client via getSession, i always have some public data that i expose via getSession and private session data which i only use in my endpoints, handle etc. also i always use a secret thats > 32 characters or even 64.

from svelte-kit-cookie-session.

You are right. On top that, data from the session (the cookie) to be processed in the backend should have low trust since it remains essentially user input.

Do you use any ready made stuff for handling the server session ?:)

from svelte-kit-cookie-session.

So is the purpose of providing a secret key to sign the session data, rather than to encrypt it?

from svelte-kit-cookie-session.

I'm using prisma and only storing the sessionId in the cookie. I can probably share some best practices in the future, currently working something out.

So this way it's becoming a statefull solution right? Storing an ID inside the cookie, then use this ID to do a lookup in a database serverside? I'm thinking of doing something like that as well, using firestore as a database...
When you say best practices, what do you mean exactly?

from svelte-kit-cookie-session.