# How to Use Signed Cookies Integration

**Signed Cookies** is a *serverless* integration, divided in two parts, available at Azion Marketplace.

Signed cookies are a type of cookie that has an extra layer of security. Cookies that are signed have the information within them encrypted and can only be read by the website that created them. Signed cookies are often used for authentication purposes; for example, to remember if a user has logged in to a website. This allows the website to verify whether third parties have interfered with or altered the session data. This is an effective defense against session hijacking and other security attacks.

Signed cookies can include a timestamp or expiration date in addition to encryption. This ensures that the data is only valid for a limited time. All in all, signed cookies are a vital tool for web developers to maintain security and integrity of user data.

---

## Getting the integration

This integration is, in fact, two. The Signed Cookies integration is divided into the **hash generator** and the **hash validator**.

To install the integration, follow these steps:

1. Access [Azion Console](/en/documentation/products/guides/how-to-access-azion-console/) > **Marketplace**.  
2. On the Marketplace homepage, look for the **Signed Cookies** integration.
  - You can search any integration by browsing through the cards, using the filters, or typing a keyword in the search bar.
3. Once you've found the *Signed Cookies - Hash Generator* and *Signed Cookies - Hash Validator* cards, select one to go to the integration's page.
4. On the integration's page, click the **Install** button.

A message appears indicating that your integration was successfully installed.

Then, follow the same steps to install the second integration.

---

## Configuring the integration

To use the Signed Cookies integration, you must have at least one application to incorporate the new function.

:::tip
Go to the [building section](/en/documentation/products/guides/build/build-an-application/) for more details on how to build an application.
:::

To configure your integration, proceed as follows:

1. On the upper-left corner, select **Products menu** > **Application** on the **Build** section.
2. On the listing page of your applications, select the one you want to use with the **Signed Cookies** integration.
3. On the **Main Settings** tab, under **Modules**, locate the **Functions** switch and turn it on to enable **Functions** on your application.
4. Still under the **Modules** section, locate the **Application Accelerator** switch and turn it on to enable the **Forward Cookies** functionality for your application.
  - This will be addressed later at the [Rules Engine section](#configuring-a-rule-on-rules-engine).
5. Click the **Save** button.

You'll receive a success message indicating that your application has been updated.

:::caution[Warning]
If a product or module is activated, it could generate usage-related costs. Check the [pricing page](/en/documentation/products/pricing/) for more information.
:::

---

## Instantiating the integration

To enable this function, while still on the **Application** page:

1. Select the **Functions Instances** tab on the top list.
2. Click the **+ Function Instance** button.
3. Choose an easy to remember name for your function.
4. On the dropdown function menu, select the **Signed Cookies** function.
  - This action will load the **Arguments** tab.

:::note
As you have two integrations, you'll have to configure two **Arguments** tabs, one for the response phase and another one for the request phase.

In this matter, the **Hash Generator has to run on the response phase**, and the **Hash Validator has to run on the request phase**.
:::

For the **Hash Generator**, the parameters are:

```json
{
  "cookie_list": ["yummy_cookie", "tasty_cookie"],
  "cookie_secret": "ItIsASecret",
  "tampering_cookie_prefix": "tampering_protection"
}
```

Where:

- `cookie_list`: defines the list of cookies that should be protected. For each cookie in this list, an encrypted version of the cookie will be appended to the response.
- `cookie_secret`: defines a secret to protect the encrypted cookie against client-side manipulation.
- `tampering_cookie_prefix`: defines the prefix to be used in the name of the encrypted cookies.

You should pay attention to the possible values added to the `tampering_cookie_prefix`. 

For example, if the value of this argument is `tampering_protection` and the cookies are `yummy_cookie` and `tasty_cookie`, the encrypted cookies created by the function will be named `tampering_protection_yummy_cookie` and `tampering_protection_tasty_cookie`.

If this argument doesn't have a valid value, then the default value `azion_tampering` is used. Therefore, in this case, the encrypted cookies would be `azion_tampering_yummy_cookie` and `azion_tampering_tasty_cookie`.

For the **Hash Validator**, the parameters are:

```json
{
  "cookie_list": ["yummy_cookie", "tasty_cookie"],
  "cookie_secret": "ItIsASecret",
  "tampering_cookie_prefix": "tampering_protection",
  "tampering_violation_header_prefix": "azion-tampering-violation"
}
```

These are the same fields of the Signed Cookies - Hash Generator, with the addition of one more field, `tampering_violation_header_prefix`. It defines a prefix to the headers which the function will append to the request whenever a cookie violation is identified.

You should pay attention to the possible values added to `tampering_violation_header_prefix`. 

For example, the `Cookie-Violation-Any`, `Cookie-Violation-Counter`, and `Cookie-Violation-List` headers will be created if the value of this argument is `Cookie-Violation`.

If this argument doesn't have valid data, the defaults are `Azion-Tampering-Violation-Any`, `Azion-Tampering-Violation-Counter`, and `Azion-Tampering-Violation-List`.

---

## Configuring a rule on Rules Engine

Now you have to configure the rules you want (*criteria* and *behavior*) to apply to run your function.

First, you have to configure the **response phase** for the **Rules Engine**.

Still in the **Application** page, follow these steps:

1. Select the **Rules Engine** tab.
2. Click the **+ Rule Engine** button.
3. Give an easy to remember name to your rule.
4. Select **Response Phase**.
5. Pass the *criteria* you need to in order to run your integration.
6. On the *behavior* field, select **Run Function** from the dropdown menu.
7. Select the **Signed Cookies - Hash Generator** function, according to the name you gave it in the instantiation step.
8. Click the **Save** button.

Then, you have to configure the **request phase** for the **Rules Engine**.

Still in the **Application** page, follow these steps:

1. Select the **Rules Engine** tab.
2. Click the **+ Rule** button and 
3. Give an easy to remember name to your rule.
4. Select **Request Phase**.
5. Pass the *criteria* you need to in order to run your integration.
6. On the *behavior* field, select **Run Function** from the dropdown menu.
7. Select the **Signed Cookies - Hash Validator** function, according to the name you gave it in the instantiation step.
    - You'll also need a *second behavior* for the **Signed Cookies - Hash Validator** function: **Forward Cookies**. 
8. To add it, click the **+ Add Behavior** button and select the **Forward Cookies** option from the dropdown menu.
9. Click the **Save** button.

Done. You've successfully instantiated your two integrations and are now protected against attackers.

---