A cookie value the server alone can have written: base64url JSON plus an
HMAC-SHA256 over it, keyed by HKDF from secret with label as the info,
so each use gets its own key and one cookie can't stand in for another.
Every payload carries its own exp, so a copied value dies with its cookie.
A cookie value the server alone can have written: base64url JSON plus an HMAC-SHA256 over it, keyed by HKDF from
secretwithlabelas the info, so each use gets its own key and one cookie can't stand in for another. Every payload carries its ownexp, so a copied value dies with its cookie.