Why is secret required?

[youfoundKim]

Prerequisites

• I have written a descriptive issue title
• I have searched existing issues to ensure the issue has not already been raised

Issue

Why is options.secret required?

I can understand signing a JWT or some other kind of stateless token, but what's the point in signing a completely random string of characters?

The current OWASP recommendation for session IDs is:

• The session ID length must be at least 128 bits (16 bytes).
• The session ID value must provide at least 64 bits of entropy.

Source

You only need to sign the cookie when the cookie itself holds state and therefore isn't random. That's why JWTs are signed. They hold state, such as the user id and roles. But a session ID is usually just a random string of characters, such as a uuid or randomBytes -> toString. That kind of data doesn't need a signature.

I think it would be a better solution to remove the options.secret requirement so users who are using randomely generated session IDs are not signing the cookie for no reason. And if some people want to store a stateless token in the cookie with this library, they can set a secret for cookie signing.

Thanks

[mcollina]

My understanding is that signing cookies is necessary to prevent some attacks.m, e.g. cookie tossing.

[rolanday]

Secret is required, but, similar to @fastify/cookie, the prop optionally accepts mapping for sign and unsigned methods so you can write out whatever you like, including clear. Good thing, because @fastify/session would be useless to me otherwise as I use fastify as backend for frontend, where frontend is remix and I need to be able to read the cookie from remix server-side. Naturally, I encrypt the cookie.

[jshear]

For anyone looking for more detailed justification, there's a good breakdown of the key benefits of signing session IDs Here.

Namely, the security of the system should not depend on the session ID generator being properly random and secure. Adding a signature removes the risk associated with predictable session IDs from a faulty generator.

Another (non-essential) benefit is that it can significantly reduce lookups during a DOS attack by validating issuance and expiration as part of the signed session ID itself before bothering to look up the session ID in the store.

[Uzlopak]

thank you