{"action":"created","issue":{"url":"https://api.github.com/repos/laravel/framework/issues/6679","labels_url":"https://api.github.com/repos/laravel/framework/issues/6679/labels{/name}","comments_url":"https://api.github.com/repos/laravel/framework/issues/6679/comments","events_url":"https://api.github.com/repos/laravel/framework/issues/6679/events","html_url":"https://github.com/laravel/framework/issues/6679","id":52177663,"number":6679,"title":"[5.0] Add The Ability To Use Non-Encrypted Cookies","user":{"login":"davejamesmiller","id":236616,"avatar_url":"https://avatars.githubusercontent.com/u/236616?v=3","gravatar_id":"","url":"https://api.github.com/users/davejamesmiller","html_url":"https://github.com/davejamesmiller","followers_url":"https://api.github.com/users/davejamesmiller/followers","following_url":"https://api.github.com/users/davejamesmiller/following{/other_user}","gists_url":"https://api.github.com/users/davejamesmiller/gists{/gist_id}","starred_url":"https://api.github.com/users/davejamesmiller/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davejamesmiller/subscriptions","organizations_url":"https://api.github.com/users/davejamesmiller/orgs","repos_url":"https://api.github.com/users/davejamesmiller/repos","events_url":"https://api.github.com/users/davejamesmiller/events{/privacy}","received_events_url":"https://api.github.com/users/davejamesmiller/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/laravel/framework/labels/medium%20priority","name":"medium priority","color":"fad8c7"},{"url":"https://api.github.com/repos/laravel/framework/labels/proposal","name":"proposal","color":"d4c5f9"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2014-12-16T22:43:05Z","updated_at":"2015-04-15T19:38:51Z","closed_at":null,"body":"This has been discussed a few times (#6421, #4134, #3440) without resolution. I'd like to offer to write the code for this, but I need to know what direction to take - i.e. would any of these actually make it into Laravel? Here are the options I can think of / find in other issues:\r\n\r\n**1.** The simplest solution, which I [have already written code for](https://github.com/laravel/framework/issues/6421#issuecomment-65940223) is to differentiate the encrypted/plain cookies with a prefix before the name when getting/setting them, e.g.:\r\n\r\n```php\r\n// Write a cookie named \"hello\" with a value of \"world\" (unencrypted)\r\nCookie::queue('plain::hello', 'world');\r\n\r\n// Reading unencrypted cookies\r\n$hello = Cookie::get('plain::hello'); // world\r\n\r\n// It won't allow unsigned cookies to be read without the prefix\r\nCookie::get('hello'); // null\r\n```\r\n\r\nThe prefix is TBD - it could be `plain`, `raw`, `unsigned`, `unencrypted` or something else. Note that the prefix is not actually used in the cookie name that's sent to the browser, because one of the major uses of this is interoperability with non-Laravel applications where we can't choose the cookie name.\r\n\r\nI chose `::` as the separator here because I think it's very rare for it to be used in cookie names, but technically it's allowed so the Symfony cookie class doesn't complain.\r\n\r\n(Potentially there could be other prefixes, e.g. `signed::` for the Laravel 3 (or was it 4.0?) method of signing cookies rather than fully encrypting them - if there's any value to that. I'm not sure that there is, just an idea.)\r\n\r\nA slight variation would be to use have a [suffix like `_signed`](https://github.com/laravel/framework/issues/3440#issuecomment-39604887) that's actually used in the cookie name for signed/encrypted cookies - and since only Laravel can decrypt them there should be no interoperability issues. But that would break backwards compatibility in a rather insecure & hard to detect way, since existing apps may assume that cookies are encrypted by default, so I don't think it's a good idea.\r\n\r\n**2.** [Another option](https://github.com/laravel/framework/issues/3440#issuecomment-40107349) is to have a list of the cookies that shouldn't be encrypted/decrypted in the config:\r\n\r\n```php\r\n'unguarded_cookies' => ['legacy_session', 'js-token'],\r\n```\r\n\r\nThe advantage is this is the simplest option to understand.\r\n\r\nThe downside is you can't tell just by looking at the code whether or not a cookie can be trusted. Also packages might need a way to add their own cookies to this list, and I'd suggest adding `XSRF-Token` to it automatically too.\r\n\r\n**3.** A [third option](https://github.com/laravel/framework/issues/3440#issuecomment-37381659) is to have a separate facade for non-encrypted cookies:\r\n\r\n```php\r\nPlainCookie::queue('hello', 'world');\r\n$hello = PlainCookie::get('hello'); // world\r\n```\r\n\r\nThere is the added complication of `Request::cookie()` though, which would maybe need an equivalent `Request::plainCookie()`. My concern with this option is it could require a lot of changes and get a bit ugly - though I haven't actually tried writing any code yet so I may be wrong.\r\n\r\n**4.** For setting the cookies, there could be a wrapper method that creates a different Cookie subclass, telling the middleware not to encrypt them:\r\n\r\n```php\r\nCookie::queue(Cookie::plain('hello', 'world'));\r\n```\r\n\r\nHowever, I don't think this would work as I can't see any way to ensure that other cookies are still encrypted when reading them (`Cookie::get()`). The same would apply to adding another parameter to `Cookie::make()` - though it has a lot already so I wouldn't recommend that one.\r\n\r\n---\r\n\r\nIf none of these would make it into core, and no-one has a better suggestion, I will probably implement option 1 (or maybe option 2) as a separate middleware package, replacing `EncryptCookies`.\r\n\r\nBut I personally think it should be in core because then the `XSRF-Token` cookie doesn't need to be encrypted unnecessarily, removing ~238 bytes from every request & response (pre-gzip) and saving [some confusion](https://github.com/laravel/framework/issues/6541)."},"comment":{"url":"https://api.github.com/repos/laravel/framework/issues/comments/93543029","html_url":"https://github.com/laravel/framework/issues/6679#issuecomment-93543029","issue_url":"https://api.github.com/repos/laravel/framework/issues/6679","id":93543029,"user":{"login":"franzliedke","id":249125,"avatar_url":"https://avatars.githubusercontent.com/u/249125?v=3","gravatar_id":"","url":"https://api.github.com/users/franzliedke","html_url":"https://github.com/franzliedke","followers_url":"https://api.github.com/users/franzliedke/followers","following_url":"https://api.github.com/users/franzliedke/following{/other_user}","gists_url":"https://api.github.com/users/franzliedke/gists{/gist_id}","starred_url":"https://api.github.com/users/franzliedke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/franzliedke/subscriptions","organizations_url":"https://api.github.com/users/franzliedke/orgs","repos_url":"https://api.github.com/users/franzliedke/repos","events_url":"https://api.github.com/users/franzliedke/events{/privacy}","received_events_url":"https://api.github.com/users/franzliedke/received_events","type":"User","site_admin":false},"created_at":"2015-04-15T19:38:51Z","updated_at":"2015-04-15T19:38:51Z","body":"@taylorotwell Can you tell us which direction you'd prefer? I don't want to put any work into this if I ultimately do something you won't like..."}}