Same text format doesn't mean the same signature | Xiliux Blog

We had the same session written twice —one copy per application— and a shared library to stop duplicating it. The token looks identical in all three: id|version|expiry|signature, an HMAC-SHA256 over the payload. The temptation was obvious: «same three-field format, the migration is transparent, live cookies keep working». We took it for granted.... Weiterlesen: Same text format doesn't mean the same signature | Xiliux Blog