Pass-through to a PHP “”“micro service”“” to decode the cookie and pass it back to Elixir to re-negotiate. Probably what I’d do if pressed and really wanted to get the elixir app into production.
Depends on your timeline, if 3 months is the cutoff, and you wont be in prod before then, just patch the PHP to transform them into reasonable cookies now and not worry about it later?
The PHP code is probably like 10 lines to catch a POST, hit mcrypt and send the response? You only have to hit it once per cookie over that 3 month window, so any performance penalty is probably slim. Run your internal request over HTTPS and it’s still reasonably secure?
It’s an idea anyway.
