@@ -71,11 +71,9 @@ func (store *SessionStore) Save(rw http.ResponseWriter, req *http.Request, s *se
7171 return err
7272 }
7373
74− ticketCookie := cookies.MakeCookieFromOptions(
74+ ticketCookie := store.makeCookie(
7575 req,
76− store.CookieOptions.CookieName,
7776 ticketString,
78− store.CookieOptions,
7977 store.CookieOptions.CookieExpire,
8078 s.CreatedAt,
8179 )
@@ -91,8 +89,12 @@ func (store *SessionStore) Load(req *http.Request) (*sessions.SessionState, erro
9189 if err != nil {
9290 return nil, fmt.Errorf("error loading session: %s", err)
9391 }
94− // No cookie validation necessary
95− session, err := store.LoadSessionFromString(requestCookie.Value)
92+
93+ val, _, ok := cookie.Validate(requestCookie, store.CookieOptions.CookieSecret, store.CookieOptions.CookieExpire)
94+ if !ok {
95+ return nil, fmt.Errorf("Cookie Signature not valid")
96+ }
97+ session, err := store.LoadSessionFromString(val)
9698 if err != nil {
9799 return nil, fmt.Errorf("error loading session: %s", err)
98100 }
@@ -132,12 +134,15 @@ func (store *SessionStore) LoadSessionFromString(value string) (*sessions.Sessio
132134func (store *SessionStore) Clear(rw http.ResponseWriter, req *http.Request) error {
133135 requestCookie, _ := req.Cookie(store.CookieOptions.CookieName)
134136
137+ val, _, ok := cookie.Validate(requestCookie, store.CookieOptions.CookieSecret, store.CookieOptions.CookieExpire)
138+ if !ok {
139+ return fmt.Errorf("Cookie Signature not valid")
140+ }
141+
135142 // We go ahead and clear the cookie first, always.
136− clearCookie := cookies.MakeCookieFromOptions(
143+ clearCookie := store.makeCookie(
137144 req,
138− store.CookieOptions.CookieName,
139145 "",
140− store.CookieOptions,
141146 time.Hour*-1,
142147 time.Now(),
143148 )
@@ -145,10 +150,9 @@ func (store *SessionStore) Clear(rw http.ResponseWriter, req *http.Request) erro
145150
146151 // We only return an error if we had an issue with redis
147152 // If there's an issue decoding the ticket, ignore it
148− ticket, _ := decodeTicket(store.CookieOptions.CookieName, requestCookie.Value)
153+ ticket, _ := decodeTicket(store.CookieOptions.CookieName, val)
149154 if ticket != nil {
150− deleted, err := store.Client.Del(ticket.asHandle(store.CookieOptions.CookieName)).Result()
151− fmt.Println("delted %n", deleted)
155+ _, err := store.Client.Del(ticket.asHandle(store.CookieOptions.CookieName)).Result()
152156 if err != nil {
153157 return fmt.Errorf("error clearing cookie from redis: %s", err)
154158 }
@@ -156,6 +160,21 @@ func (store *SessionStore) Clear(rw http.ResponseWriter, req *http.Request) erro
156160 return nil
157161}
158162
163+// makeCookie makes a cookie, signing the value if present
164+func (store *SessionStore) makeCookie(req *http.Request, value string, expires time.Duration, now time.Time) *http.Cookie {
165+ if value != "" {
166+ value = cookie.SignedValue(store.CookieOptions.CookieSecret, store.CookieOptions.CookieName, value, now)
167+ }
168+ return cookies.MakeCookieFromOptions(
169+ req,
170+ store.CookieOptions.CookieName,
171+ value,
172+ store.CookieOptions,
173+ expires,
174+ now,
175+ )
176+}
177+
159178func (store *SessionStore) storeValue(value string, expiresOn time.Time, requestCookie *http.Cookie) (string, error) {
160179 var ticket *TicketData
161180 if requestCookie != nil {