Struct pavex::cookie::config::CryptoRule

pub struct CryptoRule {
    pub cookie_names: Vec<String>,
    pub algorithm: CryptoAlgorithm,
    pub key: Key,
    pub fallbacks: Vec<FallbackConfig>,
}

CryptoRule specifies whether certain cookies should be encrypted or signed.

Fields

cookie_names: Vec<String>

The names of the cookies to which this rule applies.

algorithm: CryptoAlgorithm

How the cookies should be secured: either encryption or signing.

key: Key

The key to use for encryption or signing.

Requirements

The key must be at least 64 bytes long and should be generated using a cryptographically secure random number generator.

fallbacks: Vec<FallbackConfig>

Fallbacks are used to decrypt/verify request cookies that failed to be decrypted/verified using the primary key.
Fallbacks are never used to encrypt/sign response cookies.

Key rotation

Fallbacks exist to enable key and algorithm rotation.
From time to time, you may want to change the key used to sign or encrypt cookies, or update the algorithm.
If you do this naively (e.g. change CryptoRule::key or CryptoRule::algorithm to a new value), the server will immediately start rejecting all existing cookies because they were signed/encrypted with the old key/algorithm.

With fallbacks, you can start using the new configuration without invalidating all existing cookies. The process for key rotation goes as follows:

1. Generate a new key
2. Set key to the new key, and add the old key to the fallbacks vector, using the same algorithm
3. Wait for the expiration of all cookies signed/encrypted with the old key
4. Remove the old key from the fallbacks vector

Trait Implementations

impl Clone for CryptoRule

fn clone(&self) -> CryptoRule

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CryptoRule

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for CryptoRule

fn deserialize<__D>( __deserializer: __D, ) -> Result<CryptoRule, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.