Improve session cookie hashing

[roblillack]

Currently, Mars uses SHA-1 to sign the content of the session cookies, which is considered broken for nearly 20 years now.

This PR changes this to use SHA256 by default and improves overall security by enabling the “http only” and “secure” flags where applicable and if not set by the app's configuration. Also, a random app secret will be used, if none is set by the application.

[coveralls]

Coverage increased (+0.1%) to 60.377% when pulling de46bbf on improve-session-cookie-hashing into c4c1b47 on master.

[Copilot]

Pull Request Overview

This pull request upgrades the session cookie signing algorithm from SHA-1 to SHA256, improves cookie security by enforcing HttpOnly and Secure flags, and adjusts session expiration settings.

• Upgrades hashing method in sign.go and removes deprecated libs.go
• Updates cookie format and expiration duration in session.go and mars.go
• Adds tests and fuzz tests for signing and session decoding

Reviewed Changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
sign_test.go	Adds tests to ensure proper secret key setup and signature functionality
sign_fuzz_test.go	Introduces fuzz tests for signature verification
sign.go	Implements session signing using SHA256 with updated encoding
session_fuzz_test.go	Fuzz testing for session cookie decoding
session.go	Updates cookie structure and session expiration duration
mars.go	Enhances cookie flag defaults and initializes secret key appropriately
libs.go	Removes legacy SHA-1 based signing code

[coveralls]

coverage: 60.12% (+0.1%) from 59.979%
when pulling cd6af3e on improve-session-cookie-hashing
into 2eb66e5 on master.