module Rack::Protection::Encryptor

def self.decrypt_message(data, secret)
  return unless data
  cipher = OpenSSL::Cipher.new(CIPHER)
  cipher_text, iv, auth_tag = data.split(DELIMITER, 3).map! { |v| base64_decode(v) }
  # This check is from ActiveSupport::MessageEncryptor
  # see: https://github.com/ruby/openssl/issues/63
  return if auth_tag.nil? || auth_tag.bytes.length != 16
  cipher.decrypt
  cipher.key = secret[0, cipher.key_len]
  cipher.iv  = iv
  cipher.auth_tag = auth_tag
  cipher.auth_data = ''
  decrypted_data = cipher.update(cipher_text)
  decrypted_data << cipher.final
  decrypted_data
rescue OpenSSL::Cipher::CipherError, TypeError, ArgumentError
  nil
end