integrate cookie-signature

[Uzlopak]

I know you maybe dont like to integrate the cookie-signature package, but I think it has some benefits.

• We can specify which algorithm we want to use for the signing. So you can specify e.g. sha512 or sha1 instead of sha256
• standalone unsign-function will be able to handle multiple secrets and will return an UnsignResult Object, basically unifying the behaviour of unsign from the signerFactory with the standalone unsign-Function
• because the return value of the unsign function is changed, it probably means a semver major

Checklist

• run npm run test and npm run benchmark
• tests and/or benchmarks are included
• documentation is changed or added
• commit message and code follows the Developer's Certification of Origin
  and the Code of conduct

[jsumners]

Have we tried to get the feature added upstream instead of copying their code here?

I am not blocking at this point.

[Uzlopak]

Is it an issue that it is a breaking change? I could still export Signer also as signerFactory, keeping it backwards compatible...

[climba03003]

I could still export Signer also as signerFactory, keeping it backwards compatible...

Yes, please. Reduce breaking changes when possible.
Please keep the name signerFactory as it already exposed in 7.2.0.

[mcollina]

lgtm

[budarin]

I would like any description in the documentation on the proposed features

[Uzlopak]

Ok so far?

[budarin]

Ok so far?

any docs?

[Uzlopak]

Well i am actually more interested about the integration with e.g. @fastify/session. Should we e.g. use then the shorthandle on fastify.signCookie and fastify.unsignCookie instead of using sign and unsign.

Other than that i think documentation is only needed for the algorithm option.

[mcollina]

Explicitly marking it as changes needed: drop the dummy secret.

[mcollina]

lgtm