Secure key

[lancejjohnson]

The current implementation contains two potential security
vulnerabilities. The Redis key assigned by Redbird could be manipulated
to potentially access other data in Redis and assign it as part of the
user's session information. Values stored in Redis are also being
deserialized using an Erlang function that can execute functions stored
as values.

This change closes those potential security vulnerabilities by
cryptographically signing the Redis key used by Redbird and by using a
deserialization function that safely handles Erlang terms including
functions. When a user places a key-value in Redis via Redbird, Redbird
generates a key, signs it, and optionally prepends the namespace. When
accessing the key from Redis, Redbird verifies the key, rejects keys
that have been tampered with, and safely deserializes the stored Erlang
terms. Likewise, Redbird only permits deletion of keys that are valid.

[germsvel]

Lance, so much good work here! 🎉

Left a few comments. Let me know if anything is unclear or if I can help in any other way.

[mike-burns]

I think this solution makes sense, and I like the refactoring. I have one question about what might be a fallback.

[germsvel]

I left a couple of last minor comments. You don't have to make those changes if you don't want. This looks really good!

Thanks for doing all this work 🎉

[lancejjohnson]

@germsvel I no longer have the ability to merge this PR and/or run the release script. Would you be willing to do that when you get a chance? Sorry for leaving this loose end.

[danadaldos]

@germsvel @lancejjohnson Hey friends! We're also running into the issue described here: #72 and will be anxiously awaiting a resolution. In the meantime, would it be possible to update the description on this PR to the commit message here?:

The current implementation contains two potential security
vulnerabilities. The Redis key assigned by Redbird could be manipulated
to potentially access other data in Redis and assign it as part of the
user's session information. Values stored in Redis are also being
deserialized using an Erlang function that can execute functions stored
as values.

This change closes those potential security vulnerabilities by
cryptographically signing the Redis key used by Redbird and by using a
deserialization function that safely handles Erlang terms including
functions. When a user places a key-value in Redis via Redbird, Redbird
generates a key, signs it, and optionally prepends the namespace. When
accessing the key from Redis, Redbird verifies the key, rejects keys
that have been tampered with, and safely deserializes the stored Erlang
terms. Likewise, Redbird only permits deletion of keys that are valid.

[germsvel]

Just updated the PR description. Thanks for pointing that out @danadaldos!