Skip to content

Commit

Permalink
Remove Rails 7 cookie rotation
Browse files Browse the repository at this point in the history
This has not been needed since this app was deployed (if at all, as I
don't think this app uses sessions).
  • Loading branch information
kevindew committed Dec 28, 2022
1 parent caf8d4f commit 8e234ec
Showing 1 changed file with 0 additions and 17 deletions.
17 changes: 0 additions & 17 deletions config/application.rb
Original file line number Diff line number Diff line change
Expand Up @@ -131,22 +131,5 @@ class Application < Rails::Application

# Do not swallow errors in after_commit/after_rollback callbacks.
# config.active_record.raise_in_transactional_callbacks = true

# Rotate SHA1 cookies to SHA256 (the new Rails 7 default)
# TODO: Remove this after existing user sessions have been rotated
# https://guides.rubyonrails.org/v7.0/upgrading_ruby_on_rails.html#key-generator-digest-class-changing-to-use-sha256
Rails.application.config.action_dispatch.cookies_rotations.tap do |cookies|
salt = Rails.application.config.action_dispatch.authenticated_encrypted_cookie_salt
secret_key_base = Rails.application.secrets.secret_key_base
next if secret_key_base.blank?

key_generator = ActiveSupport::KeyGenerator.new(
secret_key_base, iterations: 1000, hash_digest_class: OpenSSL::Digest::SHA1
)
key_len = ActiveSupport::MessageEncryptor.key_len
secret = key_generator.generate_key(salt, key_len)

cookies.rotate :encrypted, secret
end
end
end

0 comments on commit 8e234ec

Please sign in to comment.