title: what is meaning of Django signed cookie?
body: <p>Is value of signed cookie secure? I supposed that value of signed cookie is encrypting at response and decrypting at request.
  <a href="https://docs.djangoproject.com/en/4.0/ref/request-response/#django.http.HttpResponse.set_signed_cookie" rel="nofollow noreferrer">Here is no detail</a> information about it</p>
  <p>But when I tried to get value of signed cookie it was visible:</p>
  <pre class="lang-py prettyprint-override"><code>from django.http.response import JsonResponse as J
  j = J({})
  j.set_signed_cookie(&quot;the_key&quot;, &quot;the_value&quot;)
  j.cookies[&quot;the_key&quot;].value
  
  &gt; 'the_value:1newi4:nTgUngl_0y6YkqJd711GqMkAQFwXORbug6CdcL_Jo2Q'
  
  j.cookies[&quot;the_key&quot;].coded_value
  
  &gt;'the_value:1newi4:nTgUngl_0y6YkqJd711GqMkAQFwXORbug6CdcL_Jo2Q'
  </code></pre>
  <p>What is the meaning of <code>coded_value</code>? <code>the_value</code> is clearly visible in both ways.</p>
  <p>Is Django has a some standard way to encrypt cookie value that may be readable only at server side?</p>
  <ul>
  <li><strong>Edit 1: Add extra question</strong></li>
  </ul>
  <p>According <a href="https://docs.djangoproject.com/en/4.0/topics/signing/" rel="nofollow noreferrer">this article</a> (thanks to <code>deceze</code> comment) I'm able to &quot;mask&quot; <code>the_value</code>:</p>
  <pre class="lang-py prettyprint-override"><code>from django.core import signing
  signer = signing.TimestampSigner()
  j.set_signed_cookie(&quot;the_key&quot;, signer.sign_object('the_value'))
  
  &gt; 'InRoZV92YWx1ZSI:1nex5S:42ra790Q3X-Epn4CsWGe_FJkGfbLcb5GroNw-Hk4Yk8:1nex5S:R9HcGACaH3S0Lr84mt899EzCZAkao_S1pgjjhoMzSZo'
  </code></pre>
  <p>But I still not sure is it encrypted value or just serialized and may be simply desirialized at browser side?</p>
  <p>And if just serialized →</p>
  <blockquote>
  <p>Is Django has a some standard way to encrypt cookie value that may be readable only at server side?</p>
  </blockquote>