Problem - Kevin Tafuro

8.14 Authenticating with HTTP Cookies
Problem
You are developing a CGI application for the Web and need to store data on the client’s
machine using a cookie, but you want to prevent the client from viewing the
data or modifying it without your application being able to detect the change.
Solution
Web cookies are implemented by setting a value in the MIME headers sent to the client
in a server response. If the client accepts the cookie, it will present the cookie
back to the server every time the specified conditions are met. The cookie is stored
on the client’s computer, typically in a plaintext file that can be modified with any
editor. Many browsers even provide an interface for viewing and editing cookies that
have been stored.
A single MIME header is a header name followed by a colon, a space, and the header
value. The format of the header value depends on the header name. Here, we’re concerned
with only two headers: the Set-Cookie header, which can be sent to the client
when presenting a web page, and the Cookie header, which the client presents to the
server when the user browses to a site which stores a cookie.
To ensure the integrity of the data that we store on the client’s computer with our
cookie, we should encrypt and MAC the data. The server does encoding when setting
a cookie, then decrypts and validates whenever the cookie comes back. The
server does not share its keys with any other entity—it alone uses them to ensure
that the data has not been read or modified since it originally left the server.
Discussion
When encrypting and MAC’ing the data stored in a cookie, we encounter a problem:
we can use only a limited character set in cookie headers, yet the output of our
cryptographic algorithms is always binary. To solve this problem, we encode the
binary data into the base64 character set. The base64 character set uses the uppercase
letters, the lowercase letters, the numbers, and a few pieces of punctuation to
represent data. Out of necessity, the length of data grows considerably when base64encoded.
We can use the spc_base64_encode( ) function from Recipe 4.5 for base64
encoding to suit our purposes.
The first thing that the server must do is call spc_cookie_init( ), which will initialize
a context object that we’ll use for both encoding and decoding cookie data. To simplify
the encryption and MAC’ing process, as well as reduce the complexity of sending
and processing received cookies, we’ll use CWC mode from Recipe 5.10.
Authenticating with HTTP Cookies | 419
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.