Encrypted Cookies: A Deep Dive into Secure Session Management

Set-Cookie: sessionId=abc123; Path=/; HttpOnly; Secure; SameSite=Strict

Cookie: sessionId=abc123

# Pseudocode
nonce = os.urandom(12)
cipher = AESGCM(key)
ct = cipher.encrypt(nonce, plaintext, associated_data=None)
cookie_value = base64url_encode(nonce + ct)

npm install express cookie-parser @panva/hkdf
npm install crypto # built‑in, no install needed for Node 14+

// encryptedCookie.js
const crypto = require('crypto');
const hkdf = require('@panva/hkdf');

const MASTER_KEY = Buffer.from(process.env.COOKIE_MASTER_KEY, 'hex'); // 32‑byte hex

// Derive a 256‑bit key for AES‑GCM
async function getEncryptionKey() {
  return hkdf('sha256', MASTER_KEY, '', 'encrypted-cookie', 32);
}

// AEAD encrypt
async function encrypt(payload) {
  const key = await getEncryptionKey();
  const iv = crypto.randomBytes(12); // 96‑bit nonce for GCM
  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
  const plaintext = Buffer.from(JSON.stringify(payload));
  const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
  const tag = cipher.getAuthTag();
  // Store iv|ciphertext|tag
  const combined = Buffer.concat([iv, ciphertext, tag]);
  return combined.toString('base64url'); // Node 15+ supports base64url
}

// AEAD decrypt
async function decrypt(encoded) {
  const data = Buffer.from(encoded, 'base64url');
  const iv = data.slice(0, 12);
  const tag = data.slice(data.length - 16);
  const ciphertext = data.slice(12, data.length - 16);
  const key = await getEncryptionKey();
  const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
  decipher.setAuthTag(tag);
  const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
  return JSON.parse(plaintext.toString());
}

module.exports = { encrypt, decrypt };

// app.js
const express = require('express');
const cookieParser = require('cookie-parser');
const { encrypt, decrypt } = require('./encryptedCookie');

const app = express();
app.use(express.json());
app.use(cookieParser());

const COOKIE_NAME = 'session_enc';
const COOKIE_OPTS = {
  httpOnly: true,
  secure: true,
  sameSite: 'strict',
  path: '/',
  maxAge: 24 * 60 * 60 * 1000 // 1 day
};

app.post('/login', async (req, res) => {
  const { username } = req.body;
  // Authenticate user (omitted)
  const session = {
    sub: username,
    iat: Date.now(),
    exp: Date.now() + COOKIE_OPTS.maxAge
  };
  const encrypted = await encrypt(session);
  res.cookie(COOKIE_NAME, encrypted, COOKIE_OPTS);
  res.json({ message: 'Logged in' });
});

app.get('/profile', async (req, res) => {
  const token = req.cookies[COOKIE_NAME];
  if (!token) return res.status(401).json({ error: 'Missing cookie' });
  try {
    const session = await decrypt(token);
    if (session.exp < Date.now()) throw new Error('Expired');
    res.json({ user: session.sub });
  } catch (e) {
    res.clearCookie(COOKIE_NAME, COOKIE_OPTS);
    res.status(401).json({ error: 'Invalid session' });
  }
});

app.listen(3000, () => console.log('Server running on :3000'));

pip install Flask cryptography

# crypto_cookie.py
import os, json, base64
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
from cryptography.hazmat.primitives.kdf.hkdf import HKDF
from cryptography.hazmat.primitives import hashes

MASTER_KEY = os.getenv('COOKIE_MASTER_KEY').encode()  # 32‑byte raw

def derive_key():
    hkdf = HKDF(
        algorithm=hashes.SHA256(),
        length=32,
        salt=None,
        info=b'encrypted-cookie',
    )
    return hkdf.derive(MASTER_KEY)

def encrypt(payload: dict) -> str:
    key = derive_key()
    aesgcm = AESGCM(key)
    nonce = os.urandom(12)
    plaintext = json.dumps(payload).encode()
    ct = aesgcm.encrypt(nonce, plaintext, None)
    token = nonce + ct
    return base64.urlsafe_b64encode(token).decode().rstrip('=')

def decrypt(token: str) -> dict:
    data = base64.urlsafe_b64decode(token + '==')
    nonce, ct = data[:12], data[12:]
    key = derive_key()
    aesgcm = AESGCM(key)
    plaintext = aesgcm.decrypt(nonce, ct, None)
    return json.loads(plaintext)

# app.py
from flask import Flask, request, jsonify, make_response, abort
from crypto_cookie import encrypt, decrypt
import time

app = Flask(__name__)

COOKIE_NAME = 'session_enc'
MAX_AGE = 24 * 3600  # 1 day

@app.route('/login', methods=['POST'])
def login():
    username = request.json.get('username')
    # Authentication omitted
    session = {
        'sub': username,
        'iat': int(time.time()),
        'exp': int(time.time()) + MAX_AGE
    }
    token = encrypt(session)
    resp = make_response(jsonify(message='Logged in'))
    resp.set_cookie(
        COOKIE_NAME,
        token,
        max_age=MAX_AGE,
        httponly=True,
        secure=True,
        samesite='Strict',
        path='/'
    )
    return resp

@app.route('/profile')
def profile():
    token = request.cookies.get(COOKIE_NAME)
    if not token:
        abort(401, description='Missing session')
    try:
        session = decrypt(token)
        if session['exp'] < int(time.time()):
            raise ValueError('Expired')
    except Exception as exc:
        resp = make_response(jsonify(error='Invalid session'), 401)
        resp.delete_cookie(COOKIE_NAME, path='/', samesite='Strict')
        return resp
    return jsonify(user=session['sub'])

if __name__ == '__main__':
    app.run(ssl_context='adhoc')

<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>org.bouncycastle</groupId>
        <artifactId>bcprov-jdk15on</artifactId>
        <version>1.70</version>
    </dependency>
</dependencies>

// EncryptedCookieUtil.java
package com.example.security;

import org.bouncycastle.util.encoders.UrlBase64;
import javax.crypto.Cipher;
import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
import javax.crypto.spec.GCMParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import java.security.SecureRandom;
import java.time.Instant;
import java.util.Base64;
import com.fasterxml.jackson.databind.ObjectMapper;
import java.util.Map;

public class EncryptedCookieUtil {

    private static final int GCM_TAG_LENGTH = 128; // bits
    private static final int GCM_IV_LENGTH = 12;    // bytes
    private static final SecureRandom RNG = new SecureRandom();
    private static final ObjectMapper MAPPER = new ObjectMapper();

    // In production, inject via @Value or secret manager
    private static final byte[] MASTER_KEY = System.getenv("COOKIE_MASTER_KEY").getBytes();

    private static SecretKey deriveKey() throws Exception {
        // Simple HKDF using BouncyCastle
        byte[] info = "encrypted-cookie".getBytes();
        byte[] salt = new byte[0];
        HKDFBytesGenerator hkdf = new HKDFBytesGenerator(new SHA256Digest());
        hkdf.init(new HKDFParameters(MASTER_KEY, salt, info));
        byte[] okm = new byte[32];
        hkdf.generateBytes(okm, 0, okm.length);
        return new SecretKeySpec(okm, "AES");
    }

    public static String encrypt(Map<String, Object> payload) throws Exception {
        SecretKey key = deriveKey();
        byte[] iv = new byte[GCM_IV_LENGTH];
        RNG.nextBytes(iv);
        Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
        GCMParameterSpec spec = new GCMParameterSpec(GCM_TAG_LENGTH, iv);
        cipher.init(Cipher.ENCRYPT_MODE, key, spec);
        byte[] plain = MAPPER.writeValueAsBytes(payload);
        byte[] cipherText = cipher.doFinal(plain);
        byte[] combined = new byte[iv.length + cipherText.length];
        System.arraycopy(iv, 0, combined, 0, iv.length);
        System.arraycopy(cipherText, 0, combined, iv.length, cipherText.length);
        return Base64.getUrlEncoder().withoutPadding().encodeToString(combined);
    }

    public static Map<String, Object> decrypt(String token) throws Exception {
        byte[] data = Base64.getUrlDecoder().decode(token);
        byte[] iv = new byte[GCM_IV_LENGTH];
        System.arraycopy(data, 0, iv, 0, GCM_IV_LENGTH);
        byte[] cipherText = new byte[data.length - GCM_IV_LENGTH];
        System.arraycopy(data, GCM_IV_LENGTH, cipherText, 0, cipherText.length);
        SecretKey key = deriveKey();
        Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
        GCMParameterSpec spec = new GCMParameterSpec(GCM_TAG_LENGTH, iv);
        cipher.init(Cipher.DECRYPT_MODE, key, spec);
        byte[] plain = cipher.doFinal(cipherText);
        return MAPPER.readValue(plain, Map.class);
    }
}

// SessionController.java
package com.example.controller;

import com.example.security.EncryptedCookieUtil;
import org.springframework.http.ResponseCookie;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;
import java.time.Duration;
import java.util.HashMap;
import java.util.Map;

@RestController
public class SessionController {

    private static final String COOKIE_NAME = "session_enc";
    private static final Duration COOKIE_MAX_AGE = Duration.ofHours(24);

    @PostMapping("/login")
    public ResponseEntity<?> login(@RequestBody Map<String, String> body) throws Exception {
        String username = body.get("username");
        // Authentication omitted
        Map<String, Object> session = new HashMap<>();
        session.put("sub", username);
        session.put("iat", System.currentTimeMillis());
        session.put("exp", System.currentTimeMillis() + COOKIE_MAX_AGE.toMillis());

        String token = EncryptedCookieUtil.encrypt(session);
        ResponseCookie cookie = ResponseCookie.from(COOKIE_NAME, token)
                .httpOnly(true)
                .secure(true)
                .sameSite("Strict")
                .path("/")
                .maxAge(COOKIE_MAX_AGE)
                .build();

        return ResponseEntity.ok()
                .header("Set-Cookie", cookie.toString())
                .body(Map.of("message", "Logged in"));
    }

    @GetMapping("/profile")
    public ResponseEntity<?> profile(@CookieValue(value = COOKIE_NAME, required = false) String token) throws Exception {
        if (token == null) {
            return ResponseEntity.status(401).body(Map.of("error", "Missing session"));
        }
        try {
            Map<String, Object> session = EncryptedCookieUtil.decrypt(token);
            long now = System.currentTimeMillis();
            if ((Long) session.get("exp") < now) {
                throw new IllegalArgumentException("Expired");
            }
            return ResponseEntity.ok(Map.of("user", session.get("sub")));
        } catch (Exception e) {
            ResponseCookie delete = ResponseCookie.from(COOKIE_NAME, "")
                    .maxAge(0)
                    .path("/")
                    .build();
            return ResponseEntity.status(401)
                    .header("Set-Cookie", delete.toString())
                    .body(Map.of("error", "Invalid session"));
        }
    }
}

dotnet add package Microsoft.AspNetCore.DataProtection
dotnet add package System.Text.Json

// Program.cs (ASP.NET Core 7 minimal API)
var builder = WebApplication.CreateBuilder(args);

// Use Data Protection with a persisted key store (e.g., Azure Key Vault or file system)
builder.Services.AddDataProtection()
    .PersistKeysToFileSystem(new DirectoryInfo(@"./keys"))
    .SetApplicationName("EncryptedCookieDemo")
    .UseCryptographicAlgorithms(
        new AuthenticatedEncryptorConfiguration()
        {
            EncryptionAlgorithm = EncryptionAlgorithm.AES_256_GCM,
            ValidationAlgorithm = ValidationAlgorithm.HMACSHA256
        });

var app = builder.Build();

const string CookieName = "session_enc";
const int MaxAgeSeconds = 86400; // 1 day

app.MapPost("/login", async (HttpContext ctx, [FromBody] LoginRequest req) =>
{
    // TODO: Authenticate user (omitted)
    var payload = new SessionPayload
    {
        Sub = req.Username,
        Iat = DateTimeOffset.UtcNow.ToUnixTimeSeconds(),
        Exp = DateTimeOffset.UtcNow.AddSeconds(MaxAgeSeconds).ToUnixTimeSeconds()
    };

    var protector = ctx.RequestServices.GetRequiredService<IDataProtector>()
        .CreateProtector("EncryptedCookie");

    var json = JsonSerializer.Serialize(payload);
    var protectedBytes = protector.Protect(Encoding.UTF8.GetBytes(json));
    var cookieValue = WebEncoders.Base64UrlEncode(protectedBytes);

    ctx.Response.Cookies.Append(CookieName, cookieValue, new CookieOptions
    {
        HttpOnly = true,
        Secure = true,
        SameSite = SameSiteMode.Strict,
        MaxAge = TimeSpan.FromSeconds(MaxAgeSeconds),
        Path = "/"
    });

    return Results.Json(new { message = "Logged in" });
});

app.MapGet("/profile", async (HttpContext ctx) =>
{
    if (!ctx.Request.Cookies.TryGetValue(CookieName, out var cookie))
        return Results.Unauthorized();

    var protector = ctx.RequestServices.GetRequiredService<IDataProtector>()
        .CreateProtector("EncryptedCookie");

    try
    {
        var protectedBytes = WebEncoders.Base64UrlDecode(cookie);
        var jsonBytes = protector.Unprotect(protectedBytes);
        var payload = JsonSerializer.Deserialize<SessionPayload>(jsonBytes);

        if (payload.Exp < DateTimeOffset.UtcNow.ToUnixTimeSeconds())
            throw new Exception("Expired");

        return Results.Json(new { user = payload.Sub });
    }
    catch
    {
        // Delete malformed/expired cookie
        ctx.Response.Cookies.Delete(CookieName);
        return Results.Unauthorized();
    }
});

app.Run();

record LoginRequest(string Username, string Password);
record SessionPayload(string Sub, long Iat, long Exp);