in reply to Compressing data structures for cookies

I would like to store some user settings in a cookie

Don't do that.

Sooner or later, someone will figure out how to decode the cookie contents and give themselves an enhanced status that you were probably not willing to concede.

Use the cookie as, well, a cookie. That is, a random string of bits that has no intrinsic meaning. When the client returns to your site, you read the cookie and go look up the settings that are keyed to that user in some table. Think of it as a the 100 dollar note torn in half and shared between two spies. Alone, either half is worthless: it's only when you put them together that they mean anything.

A cardinal rule of web programming is to never trust the user. Don't put any semantic meaning into a cookie. Keep all that information on your server. You'll also keep you're cookie size down. 256 bits encoded in Base-64 takes 11 bytes, and I doubt you'll hit a collision before the heat death of the universe.

• another intruder with the mooring in the heart of the Perl

  • Comment on Re: Compressing data structures for cookies