signed_cookie.nx

signed_cookie.nx -- HMAC-signed tamper-evident cookies. Browser cookies are stored client-side and editable by the user. For session state you typically want the user to HOLD the state but NOT modify it. Signed cookies solve this: cookie = value || \".\" || base64url(HMAC-SHA-256(key, value)) On read: split at the last dot, verify HMAC with secret key, reject if tampered. Same idea as Rails / Django signed cookies + Express cookie-parser's signed mode + the session cookie in tens of thousands of production Python apps. Composes hmac.nx (HMAC-SHA-256) + base64.nx (for URL-safe signature bytes) + ct.nx (constant-time compare). Invariants: SC1 Only the PAYLOAD is signed -- key isn't revealed by cookie value. Tampering changes MAC -> rejected. SC2 Verification uses ct_memcmp to eliminate timing leaks. SC3 Base64url without padding keeps cookie URL-safe + single-valued (compatible with cookie attribute grammar). SC4 No expiry here -- cookie's own Max-Age / Expires attribute handles that. Replay-attack defence requires caller to include a timestamp in the payload and enforce bounds on read.