Play Framework Security Advisory
I just do not understand why we keep persisting in putting session data into cookies.Its between hard and impossible to build to systems perfectly that do this, whereas a server based lookup has a limited number of attacks that do not involve owning my boxes.I have even written my own session handling wsgi middleware just because I don't understand encryption and cannot find a framework that doesn't try that.