{"action":"opened","issue":{"url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/541","repository_url":"https://api.github.com/repos/thephpleague/oauth2-server","labels_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/541/labels{/name}","comments_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/541/comments","events_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/541/events","html_url":"https://github.com/thephpleague/oauth2-server/issues/541","id":147714595,"number":541,"title":"Reusing CryptTrait facilities","user":{"login":"msimkunas","id":9675250,"avatar_url":"https://avatars.githubusercontent.com/u/9675250?v=3","gravatar_id":"","url":"https://api.github.com/users/msimkunas","html_url":"https://github.com/msimkunas","followers_url":"https://api.github.com/users/msimkunas/followers","following_url":"https://api.github.com/users/msimkunas/following{/other_user}","gists_url":"https://api.github.com/users/msimkunas/gists{/gist_id}","starred_url":"https://api.github.com/users/msimkunas/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/msimkunas/subscriptions","organizations_url":"https://api.github.com/users/msimkunas/orgs","repos_url":"https://api.github.com/users/msimkunas/repos","events_url":"https://api.github.com/users/msimkunas/events{/privacy}","received_events_url":"https://api.github.com/users/msimkunas/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-04-12T11:17:10Z","updated_at":"2016-04-12T11:17:10Z","closed_at":null,"body":"In 5.0.0-RC1, the authorization grant generated an `oauth_authorize_request` cookie which was encrypted and decrypted using the protected methods in `CryptTrait`. 5.0.0-RC2 refactored the authorization code grant to allow for more flexible login and authorization form handling which moved the cookie creation logic outside of the authorization grant class.\r\n\r\nShould we use the `CryptTrait` trait in a custom service class to be able to encrypt/decrypt the `oauth_authorize_request` cookie outside of `AuthCodeGrant`? As it stands now, the encryption facilities can only be reused by extending the grant class.\r\n\r\nI believe that this is implementation-specific because this cookie may not be a cookie at all. It could, for example, be a database row with a unique random identifier which would not require encryption. However, if we want to utilize a cookie for this purpose we need to be able to encrypt it to prevent the `user_id` from being changed by the user. Would it be possible to somehow reuse the `encrypt`/`decrypt` methods of the `AuthCodeGrant` outside the grant class?"}}