Plug.Session.COOKIE

Stores the session in a cookie.

This cookie store is based on Plug.Crypto.MessageVerifier and Plug.Crypto.Message.Encryptor which encrypts and signs each cookie to ensure they can’t be read nor tampered with.

Since this store uses crypto features, it requires you to set the :secret_key_base field in your connection. This can be easily achieved with a plug:

plug :put_secret_key_base

def put_secret_key_base(conn, _) do
  put_in conn.secret_key_base, "-- LONG STRING WITH AT LEAST 64 BYTES --"
end

Options

• :encrypt - specify whether to encrypt cookies, defaults to true. When this option is false, the cookie is still signed, meaning it can’t be tempered with but its contents can be read;

• :encryption_salt - a salt used with conn.secret_key_base to generate a key for encrypting/decrypting a cookie;

• :signing_salt - a salt used with conn.secret_key_base to generate a key for signing/verifying a cookie;

• :key_iterations - option passed to Plug.Crypto.KeyGenerator when generating the encryption and signing keys. Defaults to 1000;

• :key_length - option passed to Plug.Crypto.KeyGenerator when generating the encryption and signing keys. Defaults to 32;

• :key_digest - option passed to Plug.Crypto.KeyGenerator when generating the encryption and signing keys. Defaults to `:sha256’;

• :serializer - cookie serializer module that defines encode/1 and decode/1 returning an {:ok, value} tuple. Defaults to :external_term_format.

Examples

# Use the session plug with the table name
plug Plug.Session, store: :cookie,
                   key: "_my_app_session",
                   encryption_salt: "cookie store encryption salt",
                   signing_salt: "cookie store signing salt",
                   key_length: 64