rails/rails — pull request #9978 by trevorturk (2013-03-28 16:48:58+00:00)
Title: Cookie store auto-upgrade

Changes:

- Automatically configure cookie-based sessions to be encrypted if `secret_key_base` is set, signed if only `secret_token` is set.

- This eliminates the need to introduce the new `EncryptedCookieStore` and `UpgradeSignatureToEncryptionCookieStore` cookie-based session stores, so we leave only the existing `config.session_store :cookie_store` option and remove the two new options introduced in 4.0.0.beta1: `encrypted_cookie_store` and `upgrade_signature_to_encryption_cookie_store`.

- Automatically upgrade existing signed cookie-based sessions from Rails 3.x to be encrypted if both `secret_key_base` and `secret_token` are set. Simply upgrade to the new key generator if only `secret_token` is set. (Pull request #9909 took care of transparently upgrading signed cookies to use the new key generator.)

Reasoning:

The signed cookie jar has changed to use the new Rails-internal key generator, so you are discouraged from having a known/shared secret for signing cookies / sharing sessions.

If signed cookies and signed session cookies are considered internal to Rails, then we can upgrade from signed to encrypted automatically if they opt-in by setting `secret_key_base`.

If that all makes sense, then we can just have the one session store for Rails: `cookie_store`. This reduces the number of config options and allows us to state the caveats around upgrading plainly in one place.

/cc @jeremy @spastorino @neerajdotname

--

@fxn (or someone else interested in documentation) I'm wondering if we should include a link to the upgrade guide, which is where the caveats/warnings/etc about setting `secret_key_base` are currently.

Should we use: http://edgeguides.rubyonrails.org/upgrading_ruby_on_rails.html or something? Should we just leave this as-is?

--

Further possible work:

I'd like to continue with a bit more work here, if these ideas make sense:

1) Standardize on `name` instead of `key` when referring to cookies. We use both now and @jeremy prefers `name` which is fine by me.

2) I think we also need to fix `PermanentCookieJar`'s `[]` method, which may have been broken in 2b773e148b. It's confusing `key` and `name`. I'm not sure why there's no failing test.

3) Rename `DummyKeyGenerator` to `LegacyKeyGenerator` -- "dummy" isn't a very descriptive name. I've settled on "legacy" to refer to signed stuff generated by Rails 3.x. I'm open to other names, but I'd like to move away from "dummy".

4) Don't remove `Dummy/LegacyKeyGenerator` in 4.1. I think we should keep this around a bit longer to ensure that people can upgrade from 3.2.x to 4.1.x etc. There's "fixme" comments in place that I'd like to remove.

4) Use `Dummy/LegacyKeyGenerator` where it makes sense instead of `MessageVerifier` directly. Anything referring to signed cookies should use `Dummy/LegacyKeyGenerator`, I believe.