Question : SignedJar::verify_result about cookie-rs

[SergioBenitez]

In general we want to avoid leaking any kind of information when performing sensitive cryptographic operations. The danger here would be that a consumer of the verify() API would make decisions based on the error value and, in doing so, leak more information than they intend. Said another way, we want to restrict consumers to making decisions based on a single bit of information, success or failure, and nothing beyond that.

I'm not sure what your familiarity is with cryptographic operations, so I apologize if you're already aware of the above. Irrespective, this is a conservative approach to security.

After having spent a bit of time hunting for a bug due to mis-decoding on my side

What error did you make on your side? Is there something we could have done to more aptly prevent the error in the first place?

[julien-leclercq]

I totally can hear that. And my little adventure of yesterday shows me that I should not overestimate my own knowledge 😄.

What error did you make on your side? Is there something we could have done to more aptly prevent the error in the first place?

Did not realize that my cookie was percent-encoded. But I am mostly using libs that expose wrappers around yours (axum_extra and reqwest).
I am using cookie-rs in tests to perform some validations and setup tasks.

To be fully honest, I am not sure what kind of bad decisions you would expect some dev to make with that error, but I guess us developers are quite creative in messing things up!