title: Given the session key and secret, how can we decrypt Rails cookies?
body: <p>I've got a question about how Rails handles cookie
  encryption/decryption.</p>
  
  <p>I've got this in my config/environment.rb</p>
  
  <pre><code>  config.action_controller.session = {
      :session_key =&gt; [some key],
      :secret =&gt; [some secret]
    }
  </code></pre>
  
  <p>And this in config/environment/production.rb et al.:</p>
  
  <pre><code>  ActionController::Base.session_options[:session_domain] = [some
  domain]
  </code></pre>
  
  <p>So far, so good -- as long as all my Rails apps have the same
  session_key and secret, and are on the same domain, they can all use
  that same cookie.</p>
  
  <p>However, a colleague now has a JSP application (on the same domain),
  with which he'd like to read the cookies I have set.</p>
  
  <p>So, given a secret and an encrypted cookie value, how would we decrypt
  it to get the contents of that cookie?</p>
  
  <p>(The docs seem to indicate this is one-way SHA1 encryption by default
  -- <a href="http://caboo.se/doc/classes/CGI/Session/CookieStore.html" rel="noreferrer">http://caboo.se/doc/classes/CGI/Session/CookieStore.html</a> -- but
  then how would my Rails applications read the contents of a cookie
  that is one-way encrypted?)</p>
  
  <p>Thanks in advance for any tips/pointers/insight,</p>
  
  <p>Joe</p>