in reply to Grab username from WP Cookie

This node falls below the community's threshold of quality. You may see it by logging in.

Replies are listed 'Best First'.
Re^2: Grab username from WP Cookie
by Your Mother (Archbishop) on Apr 01, 2020 at 14:20 UTC

    There should never be any information stored in a session cookie at all other than the name and session key. Anything else is bad security. Recommending parsing the putative JSON with regex is bad programming. Answering a PHP question with Python handwaving is bad forum participation.

[reply]
      There should never be any information stored in a session cookie at all other than the name and session key. Anything else is bad security.

      Mojolicious has a different philosophy: its session data is actually stored in the session cookie, but it is cryptographically signed with the app's secret keystring to prevent tampering.

[reply]

        I am surprised to hear that. I can understand the functional benefit and the desire and effort to make it as secure as possible but I reject leaving data on the client and passing it in headers that have to go through various proxies and app forwarding and such especially where HTTPS is not completely enforced.

[reply]
[reply]

In Section Seekers of Perl Wisdom