rails/rails — pull request #8112 by spastorino (2012-11-03 17:02:54+00:00)
Title: Encrypted cookies

1) **Sign cookies using key deriver**
Rails will derive keys if config.secret_key_base is set instead of the old config.secret_key. If secret_key_base is not set to keep backwards compatibility Rails will not derive and just use the raw secret_key as in previous versions.
Users can change the default salt for signing cookies through config.action_dispatch.signed_cookie_salt setting which is by default 'signed cookie'.

2) **cookie.encrypted method => EncryptedCookieJar**
This adds a encrypted method to CookieJar that returns a jar that'll automatically encrypt cookie values before sending them to the client and will decrypt them for read.
It also prevents from tampering by the user (or a 3rd party) throwing an ActiveSupport::MessageVerifier::InvalidSignature exception.
You must set config.secret_token_base to be able to use this feature.
Users are allowed to change the default salt used for encryption by changing config.action_dispatch.encrypted_cookie_salt which defaults to 'encrypted cookie' and can also change the salt using for signing by changing config.action_dispatch.encrypted_signed_cookie_salt which defaults to 'signed encrypted cookie'

3) **encrypted cookie store**
This adds encrypted cookie store. You now can set config.session_store :encrypted_cookie_store, key: '_myapp_session' in order to use encrypted cookies to store your session. This also makes new apps to use encrypted cookie store but default.

4) **Use derive keys for http authentication**
Just that it changes http authentication to use derived keys.
Users are allowed to change the default salt by changing config.action_dispatch.http_auth_salt which defaults to 'http authentication'

In general, please help me reviewing all this. Help me improving the docs for all this. And help me suggesting better names for the options, mostly …

config.secret_key_base
config.action_dispatch.signed_cookie_salt
config.action_dispatch.encrypted_cookie_salt
config.action_dispatch.encrypted_signed_cookie_salt
config.action_dispatch.http_auth_salt

**Note to committers**: Leave this for me to merge :).

/cc @NZKoz @meder @thaidn @emboss @nahi please help me reviewing giving crypto review :).