Entry

setcookie(), mcrypt(), and string truncation.

Feb 29th, 2000 11:23
Matt Gregory, Caroline Wise,

If your cookie strings wind up getting truncated on the client side you 
might be sending too much information.  If you have a 5k encryption key 
on 1k of data being sent to a cookie, then the resulting string will be 
5k in length.  The default Netscape cookie size is 4k/cookie, which 
means that a 5k string will be truncated to 4k.  This will completely 
garble your data when you de-crypt it.  To avoid this problem make sure 
that you never send more than 4k of data in any one string the client.  
If need be use multiple cookies.