SSL is (important as you say but) orthogonal to this issue. If you steal a non-encrypted cookie and take over a user's session the result is the same.
- Someone who hijacks a request with the cookie in it cannot see the data in the cookie. But they can access the site as the user, so there is no real world benefit to this fact. - Someone on the same computer cannot see the data in the cookie. But again, they have the cookie value, so they can access the site as the user, so there is again no real world benefit to the fact that they can't see the data in the cookie itself, because they can interact with the site and see the data there.
I guess I'm just looking for an example scenario where the cookie being encrypted offers a concrete benefit from a security standpoint.
Could be wrong here, I'm not very familiar with Yesod.
the encryption prevents reading (and thereby also -- to some extend -- but not specifically tinkering/tampering)
i'd cannot think of a web app i worked on where this was needed.
(the hashing is cool though -- tinker prevention is common to be a-good-thing)
And yes, some sort of HMAC is pretty much mandatory if you're going to do client-side session storage securely, no question.