class

Kemal::Session::MessageEncryptor

Inherits Reference < Object

Reimplements the subset of ActiveSupport::MessageEncryptor that Rails' encrypted cookie jar uses, byte-for-byte compatibly:

  • AES-256-GCM, output as strict_base64(ciphertext)--strict_base64(iv)--strict_base64(tag)
  • the "legacy" metadata envelope {"_rails":{"message":<b64>,"exp":<iso8601|null>,"pur":<purpose>}}

Note: values here are the raw cookie strings (standard base64). URL/CGI escaping of the cookie value on the wire is handled by Kemal::Session.

Constants

SEPARATOR = "--"

Constructors

from_secret(secret : String, salt : String, iterations : Int32 = 1000) : MessageEncryptor

Derives the key from a secret exactly like Rails does for cookies.

Source
new(key : Bytes)
Source

Instance methods

decrypt_and_verify(message : String, purpose : String) : String

Decrypts message, verifies its purpose and expiry, and returns the inner payload string. Raises InvalidMessage / ExpiredMessage.

Source
decrypt_bytes(message : String) : Bytes

Decrypts a raw b64--b64--b64 message. Raises InvalidMessage on any structural or authentication failure.

Source
encrypt_and_sign(payload : String, purpose : String, expires_at : Time | Nil = nil) : String

Wraps payload in the legacy metadata envelope and encrypts it.

Source
encrypt_bytes(plaintext : Bytes) : String

Encrypts raw bytes, returning b64(ciphertext)--b64(iv)--b64(tag).

Source