Ktor Login Session cookie - kotlin

Question

I am working on a login project using ktor. I am currently using the old method with session
install(Sessions) {
cookie<LoginSession>(
"login_session",
SessionStorageMemory()
){
cookie.path = "/"
cookie.extensions["SameSite"] = "lax"
val secretSignKey = hex("000102030405060708090a0b0c0d0e0f")
transform(SessionTransportTransformerMessageAuthentication(secretSignKey))
}
}
This code is the final one,so if i remove the sessionmanager and secretsignkey, it will show in plain text it's value
The rest is simple, i am routing a get /login to show the form, and a post /validate to validate the data entered by user, then if all is ok i just set the session. The problem is that i can see the session value using inspect element -> application->cookie and i can change it's value being able to login as any user , by just knowing it's id (in the session i am storing the user id). And on the expire column it does not say sesssion. What am I doing wrong?
P.S: I've read the docs for authentication feature but I want to keep this simple idea with sessions.

Answer 1

Use a Ktor session transformer to transform (authenticate or encrypt) the cookie contents.
Example:
// REMEMBER! Change ALL the digits in those hex numbers and store them safely
val secretEncryptKey = hex("00112233445566778899aabbccddeeff")
val secretAuthKey = hex("02030405060708090a0b0c")
cookie<TestUserSession>(cookieName) {
transform(SessionTransportTransformerEncrypt(secretEncryptKey, secretAuthKey))
}