public function encryptSecureCookie($value, $expire, $userid = null)
    {
        $expire = (strcmp(strtolower($expire), 'never') === 0 ? time() + 60 * 60 * 24 * 6000 : $expire);

        if (is_null($userid))
            $userid = (string)$this->RequestContext->getUserRef();

        $key = hash_hmac('sha1', $userid.$expire, $this->key);
        $encrValue = base64_encode($this->encrypt($value, md5($expire)));

        if ($this->includeSSLKey == true && ($sslKey = $this->Request->getServerAttribute('SSL_SESSION_ID')))
            $verifyKey = hash_hmac('sha1', $userid . $expire . $value . $sslKey, $key);
        else
            $verifyKey = hash_hmac('sha1', $userid . $expire . $value, $key);

        $result = array($userid, $expire, $encrValue, $verifyKey);
        return(implode('|', $result));
    }
public function encryptSecureCookie($value, $expire, $userid = null)
    {
        $expire = (strcmp(strtolower($expire), 'never') === 0 ? time() + 60 * 60 * 24 * 6000 : $expire);

        if (is_null($userid))
            $userid = (string)$this->RequestContext->getUserRef();

        $key = hash_hmac('sha1', $userid.$expire, $this->key);
        $encrValue = base64_encode($this->encrypt($value, md5($expire)));

        if ($this->includeSSLKey == true && ($sslKey = $this->Request->getServerAttribute('SSL_SESSION_ID')))
            $verifyKey = hash_hmac('sha1', $userid . $expire . $value . $sslKey, $key);
        else
            $verifyKey = hash_hmac('sha1', $userid . $expire . $value, $key);

        $result = array($userid, $expire, $encrValue, $verifyKey);
        return(implode('|', $result));
    }
public function encryptSecureCookie ( $ value , $ expire , $ userid = null ) { $ expire = ( strcmp ( strtolower ( $ expire ) , 'never' ) === 0 ? time ( ) + 60 * 60 * 24 * 6000 : $ expire ) ; if ( is_null ( $ userid ) ) $ userid = ( string ) $ this -> RequestContext -> getUserRef ( ) ; $ key = hash_hmac ( 'sha1' , $ userid . $ expire , $ this -> key ) ; $ encrValue = base64_encode ( $ this -> encrypt ( $ value , md5 ( $ expire ) ) ) ; if ( $ this -> includeSSLKey == true && ( $ sslKey = $ this -> Request -> getServerAttribute ( 'SSL_SESSION_ID' ) ) ) $ verifyKey = hash_hmac ( 'sha1' , $ userid . $ expire . $ value . $ sslKey , $ key ) ; else $ verifyKey = hash_hmac ( 'sha1' , $ userid . $ expire . $ value , $ key ) ; $ result = array ( $ userid , $ expire , $ encrValue , $ verifyKey ) ; return ( implode ( '|' , $ result ) ) ; }
Secure a cookie value

The initial value is transformed with this protocol :

secureValue = username|expire|base64((value)k,expire)|HMAC(user|expire|value,k)
where k = HMAC(user|expire, sk)
and sk is server's secret key
(value)k,md5(expire) is the result an cryptographic function (ex: AES256) on "value" with key k and initialisation vector = md5(expire)

@param string  $value  unsecure value
@param integer $expire expiration time
@param string  $userid user id, or uses RequestContext->getUserRef

@return string secured value
Secure a cookie value