Always sign cookies, also in development mode for classic style apps #1245
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Use the same session_secret setting for classic style applications as for modular apps using Sinatra::Base and always sign cookies. Before, cookies were not signed for classic style applications in development mode.
|
I'd consider this a bug, not sure why the behavior would be different between classic/modular in this case. |
|
/cc #1216 |
|
thanks! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Currently there is a surprising or at least undocumented difference in the behavior of modular and classic style apps: cookies are not signed for classic style applications in development mode, while for modular applications they are always signed, regardless of the environment.
The patch removes the redefinition of the
session_secretfor classic style applications that caused this behavior.In case the current behavior is intended, at least the docs should be updated to reflect this. Right now the README generally states (see "Using Sessions"):
Short tale of woe: I wanted to create a simple example for cookies and how they work on the HTTP level, and noticed they were not signed; then went to the docs to find out how to activate the signing of cookies; unnecessarily used
Rack::Session::Cookieas suggested in the FAQ ("If you need to set additional parameters for sessions, like expiration date, use Rack::Session::Cookie directly"), before finding out how to set the session_secret directly; still wondering, I finally read the source. And the irony: the actual example app for my students is in modular style...