Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

sergiobenitez/cookie-rs

              master @ 8e97000
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Auth Bypass: 1 prior fix. Scrutinize any change in this area.

src/secure/key.rs: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Historically, session verification relied on open-coded or legacy OpenSSL implementations, posing a risk of authentication bypass. The project migrated to audited ring-based AEAD and HMAC implementations to ensure reliable session integrity. Future changes must strictly avoid returning to custom or non-audited cryptographic primitives in this module.

Cryptography: Unsafe master key reuse across distinct cryptographic processes (such as signing versus encryption) once weakened the overall security scheme. Implementing structured key derivation via HKDF-SHA256 resolved this by creating cryptographically isolated keys from a single master input. Developers must ensure any new cryptographic sub-features derive unique keys rather than reusing existing keys directly.