As one might imagine, the base64 encoding was an untested last-minute change that I am not using in my production code because of the overhead.

Keeping the identity (say, just a username) in clear text also allows for some neat features, such as the ability to read it out via Javascript and update otherwise static HTML with a seemingly dynamic header. I'll save that for another post.

In line 189 (writing the cookie): you base64_encode() the $contents _after_ you've created the MD5 hash.

In line 166 (reading the cookie): you don't base64_decode() the $contents before performing the MD5 to compare against the checksum held in the cookie.

Line 166-167 should be:
if (md5(base64_decode($contents) . $now . $this->_secret) == $checksum) {
$this->_cached = $contents;
}

~ Cliff

And thank you for FirePHP/Wildfire, it's become an important part of my tool box.

Unfortunately the FirePHP fix was delayed a bit because I was unavailable for a while.

I am working with the Firebug team on a closer integration and a co-testing setup for Firebug 1.3 that will allow me to verify the integration between FirePHP and Firebug before new Firebug versions get released. There is also a unit-testing framework planned for 1.3 which should help a lot in preventing issues like this.

Also wanted to note that ZF1.6RC3 was not released just because of FirePHP/Wildfire. There were a dozen other critical fixes that had to make it into 1.6 but it all was great timing and the FirePHP integration did factor into the decision.