Encrypt and sign cookies in the CookieJar.

src/lucky/cookies/cookie_jar.cr

@@ -138,25 +138,38 @@
   end
 
   private def encrypt(raw_value : String) : String
-    encrypted = encryptor.encrypt(raw_value)
+    encrypted = encryptor.encrypt_and_sign(raw_value)
 
     String.build do |value|
       value << LUCKY_ENCRYPTION_PREFIX
-      value << Base64.strict_encode(encrypted)
+      value << encrypted
     end
   end
 
   private def decrypt(cookie_value : String, cookie_name : String) : String?
     return unless encrypted_with_lucky?(cookie_value)
 
     base_64_encrypted_part = cookie_value.lchop(LUCKY_ENCRYPTION_PREFIX)
-    decoded = Base64.decode(base_64_encrypted_part)
-    String.new(encryptor.decrypt(decoded))
+
+    begin
+      String.new(encryptor.verify_and_decrypt(base_64_encrypted_part))
+    rescue
+      decrypt_unsigned_cookie(base_64_encrypted_part)
+    end
   rescue e
     # an error happened while decrypting the cookie
     # we will treat that as if no cookie was passed
   end
 
+  # Fallback for cookies encrypted without HMAC signing (pre-Lucky 1.5).
+  # Without HMAC verification, decryption with the wrong key may silently
+  # return garbage data instead of failing (~1/256 chance of valid PKCS padding).
+  @[Deprecated("Unsigned cookie encryption is deprecated. Re-issue cookies to upgrade them to the signed format.")]
+  private def decrypt_unsigned_cookie(base_64_encrypted_part : String) : String?
+    decoded = Base64.decode(base_64_encrypted_part)
+    String.new(encryptor.decrypt(decoded))
+  end
+
   private def encrypted_with_lucky?(value : String) : Bool
     value.starts_with?(LUCKY_ENCRYPTION_PREFIX)
   end

src/lucky/support/message_encryptor.cr

@@ -12,7 +12,7 @@ module Lucky
     end
 
     # Encrypt and sign a message. We need to sign the message in order to avoid
-    # padding attacks. Reference: http://www.limited-entropy.com/padding-oracle-attacks.
+    # padding attacks. Reference: https://en.wikipedia.org/wiki/Padding_oracle_attack.
     def encrypt_and_sign(value : Slice(UInt8)) : String
       verifier.generate(encrypt(value))
     end
@@ -22,7 +22,7 @@ module Lucky
     end
 
     # Verify and Decrypt a message. We need to verify the message in order to
-    # avoid padding attacks. Reference: http://www.limited-entropy.com/padding-oracle-attacks.
+    # avoid padding attacks. Reference: https://en.wikipedia.org/wiki/Padding_oracle_attack.
     def verify_and_decrypt(value : String) : Bytes
       decrypt(verifier.verify_raw(value))
     end