Plain text values in encrypted cookie Slim framework -

documentation slim framework says uses encrypted cookies login. http://docs.slimframework.com/#cookie-session-store

however, when built login system , inspected cookie values chrome extension this, found there plain text values in cookie. thought have done wrong, downloaded example app slimframework staff member https://github.com/briannesbitt/slim-contextsensitiveloginlogout ..and checked value. still looks this:

a%3a2%3a%7bs%3a10%3a%22slim.flash%22%3ba%3a0%3a%7b%7ds%3a4%3a%22user%22%3bs%3a16%3a%22brian%40nesbot.com%22%3b%7d 

we can see "slim.flash", "user" session variable names, email.. how can normal if cookie "encrypted" ?

you can check configuration in github link's index.php

the default slim configuration has cookies.encrypt set false. in example, you've:

$app = new \slim\slim(); 

configure to:

$app = new \slim\slim(array(     'cookies.encrypt' => true,     'cookies.secret_key' => 'your_secret_key',     'cookies.cipher' => mcrypt_rijndael_256,     'cookies.cipher_mode' => mcrypt_mode_cbc )); 

also, if you're using mcrypt above example don't forget install extension.