Possible length extension attack

I'll take a look at this and see what we can do to mitigate.

Daggerhart, has there been any progress here?

Looks good to me, is consistent with how core does things.

Only observation would be - is it worth also using core's hash salt for the salt, so you have the ssp config salt, the private key and the hash salt being used?

Thanks @larowlan! Unfortunately I noticed your message too late so created a child for your suggestion, not sure if it will make a huge difference though, we still need to access SSP config to get a cookie name.

Crediting @plach for manual testing confirmed here https://github.com/drupalauth/simplesamlphp-module-drupalauth/pull/51#is...