Use AbstractSecureStore for security fix

AUTHORS.md

@@ -23,3 +23,4 @@ Redis Session Store authors
 - Anton Kolodii
 - Peter Karman
 - Zach Margolis
+- Zachary Belzer

lib/redis-session-store.rb

@@ -2,7 +2,7 @@
 
 # Redis session storage for Rails, and for Rails only. Derived from
 # the MemCacheStore code, simply dropping in Redis instead.
-class RedisSessionStore < ActionDispatch::Session::AbstractStore
+class RedisSessionStore < ActionDispatch::Session::AbstractSecureStore
   VERSION = '0.11.3'.freeze
   # Rails 3.1 and beyond defines the constant elsewhere
   unless defined?(ENV_SESSION_OPTIONS_KEY)

spec/redis_session_store_spec.rb

@@ -281,6 +281,13 @@
 
     let(:fake_key) { 'thisisarediskey' }
 
+    describe 'generate_sid' do
+      it 'generates a secure ID' do
+        sid = store.send(:generate_sid)
+        expect(sid).to be_a(Rack::Session::SessionId)
+      end
+    end
+
     it 'retrieves the prefixed key from redis' do
       redis = double('redis')
       allow(store).to receive(:redis).and_return(redis)

spec/support.rb

@@ -7,11 +7,24 @@ module Abstract
     end
   end
 end
+unless defined?(Rack::Session::SessionId)
+  module Rack
+    module Session
+      class SessionId
+        attr_reader :public_id
+
+        def initialize(public_id)
+          @public_id
+        end
+      end
+    end
+  end
+end
 
-unless defined?(ActionDispatch::Session::AbstractStore)
+unless defined?(ActionDispatch::Session::AbstractSecureStore)
   module ActionDispatch
     module Session
-      class AbstractStore
+      class AbstractSecureStore
         ENV_SESSION_OPTIONS_KEY = 'rack.session.options'.freeze
         DEFAULT_OPTIONS = {
           key: '_session_id',
@@ -33,7 +46,7 @@ def initialize(app, options = {})
         private
 
         def generate_sid
-          rand(999..9999).to_s(16)
+          Rack::Session::SessionId.new(rand(999..9999).to_s(16))
         end
       end
     end