Yeah, it seems safe enough - but if someone leaked...

# ktor

[andrewoma]

Yeah, it seems safe enough - but if someone leaked your key clients can spoof other users by creating and signing their own cookie. It’s probably not a risk I’d take on an external system, but is fine for my ktor experiments