I don't understand the purpose of securecokie package from gorilla. https://github.com/gorilla/securecookie/blob/master/securecookie.go. I can see that it's being used get the cookie value on server based on session id stored in cookie and hashing algorithm and keypairs. https://github.com/gorilla/sessions/blob/master/store.go

So if I understand correctly, this only protects the session data when an attacker has taken over the box. Because he will have trouble getting the value of session with all user's session id in hand. But still, if he has taken over the box, he can get everything he wants, so in reality it's not protected.

Likewise, this kind of protection cannot protect from middle man attack. If it tries to protect the middle man attack, secure flag and https is the way to go. Am I correct ?

1 Answer 1


This appears to provide a function similar to that of JSON Web Tokens (JWTs). i.e. a claims based identity token.

It will allow your web application to set cookie values, and to guarantee the integrity of the values when received in future requests.

In addition to integrity checks, securecookie also appears to allow encryption for confidentiality.

What this means

In essence it allows your application to set values and store them in a client side cookie that can't be altered by the end user, with an optional step of encryption to also prevent any reading of the value.

So you could be storing that the user is logged in as an administrator. Normally if you stored User=administrator in a cookie, this would be subject to tampering by a malicious user who has the cookie on their own machine. However, if you use securecookie you can protect this value with a cryptographically secure hash. The hashed value typically includes an expiry date and time to prevent a user from storing the cookie value and then using it at a later time (say when they do not have administrator access).

It does not protect against Man-in-the-Middle attacks or from attackers that have taken over the box. It simply enables the data about the current user (the claim) to be stored client-side.

  • thanks for your answer. This clears out my head, I do use JWT instead of this securecookie :) Apr 24, 2015 at 8:03
  • Had similar Q. Why should I deal with JWT if I can simply use secure cookie. :)
    – Dzintars
    Aug 5, 2019 at 22:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .