in src/main/java/org/apache/sling/auth/saml2/impl/TokenStore.java [169:180]
private String encode(final long expires, final String userId,
final int token, final SecretKey key) throws IllegalStateException,
UnsupportedEncodingException, NoSuchAlgorithmException,
InvalidKeyException {
String cookiePayload = "" + token + expires + "@" + userId;
Mac m = Mac.getInstance(ALGORITHM);
m.init(key);
m.update(cookiePayload.getBytes(StandardCharsets.UTF_8));
String cookieValue = byteToHex(m.doFinal());
return cookieValue + "@" + cookiePayload;
}