As title says I'm trying to implement a secure cookie protocol
HMAC(username|expiration name|data|session key, sk)
It seams that session key is not constant during whole application session lifetime. Now I'm not sure what to replace it with, someone suggested to me to use browser agent but it doesn't seem unique or too hard to produce, anyone has any suggestion?
I also wonder where should I store server key. (Hard code it into source code, or there is a batter solution?)