node.js - 什么是 koa :sess. 信号？

Question

我在 Koa 中使用 Passport.js，我注意到当生成 session cookie 时，它​​被称为 koa:sess并包含编码为 Base64 的 session 信息。然而，还有另一个 cookie 叫做 koa:sess.sig ，其目的并不明显。我的猜测是它旨在阻止攻击者欺骗 session (因为 koa:sess cookie 只包含用户 ID)，是这种情况吗？

Answer 1

来自 documentation :

signed: a boolean indicating whether the cookie is to be signed (falseby default). If this is true, another cookie of the same name with the.sig suffix appended will also be sent, with a 27-byte url-safe base64SHA1 value representing the hash of cookie-name=cookie-value againstthe first Keygrip key. This signature key is used to detect tamperingthe next time a cookie is received.