rails/rails — pull request #10074 by trevorturk (2013-04-03 13:44:50+00:00)
Title: Remove comments about removing LegacyKeyGenerator in 4.1

We have a deprecation warning in place if you set only `secret_token`, so that should alleviate any concerns we have about security here.

https://github.com/rails/rails/blob/master/railties/lib/rails/application.rb#L138-L147

People will be nagged into setting `secret_key_base`. Leaving `secret_token` set causes no harm, and its presence allows for a smooth transition from Rails 3.x to 4.x.

I propose that we leave `LegacyKeyGenerator` around beyond version 4.0.x.

I suspect that latecomers will attempt to upgrade from 3.x to whatever the most recent 4.x version happens to be. If we remove `LegacyKeyGenerator`, then people attempting to upgrade from 3.x to >= 4.1 won't be able to preserve their existing signed cookies and cookie-based sessions.