gorilla session 无效 key 大小

Question

当我创建新的 cookie 存储并执行以下操作时:

var store = sessions.NewCookieStore(securecookie.GenerateRandomKey(1), securecookie.GenerateRandomKey(2))

我收到了错误信息

crypto/aes: invalid key size 2

为什么我做错了什么？当我查看函数定义时

// NewCookieStore returns a new CookieStore.
//
// Keys are defined in pairs to allow key rotation, but the common case is
// to set a single authentication key and optionally an encryption key.
//
// The first key in a pair is used for authentication and the second for
// encryption. The encryption key can be set to nil or omitted in the last
// pair, but the authentication key is required in all pairs.
//
// It is recommended to use an authentication key with 32 or 64 bytes.
// The encryption key, if set, must be either 16, 24, or 32 bytes to select
// AES-128, AES-192, or AES-256 modes.
//
// Use the convenience function securecookie.GenerateRandomKey() to create
// strong keys.
func NewCookieStore(keyPairs ...[]byte) *CookieStore {
    return &CookieStore{
        Codecs: securecookie.CodecsFromPairs(keyPairs...),
        Options: &Options{
            Path:   "/",
            MaxAge: 86400 * 30,
        },
    }
}

我认为传递正确的参数。

Answer 1

来自您链接的文档:

// It is recommended to use an authentication key with 32 or 64 bytes.

// The encryption key, if set, must be either 16, 24, or 32 bytes to select AES-128, AES-192, or AES-256 modes.

所以你可以使用这样的东西:

//replace 16 with 24 for 192bit or 32 for 256bit.
var store = sessions.NewCookieStore(securecookie.GenerateRandomKey(16), 
                                    securecookie.GenerateRandomKey(16))

//编辑

@elithrar 在评论中也提出了一个非常有效的观点，所以请记住:

Also note that restarting your application means that it cannot read existing sessions (as new keys are generated every time) when using this method.