rails/rails — pull request #11168 by josh (2013-06-28 19:53:13+00:00)
Title: Add cookies.signed.expires cookie jar

Extracting a chainable cookie jar for a technique we use at @github to prevent cookie replays after the cookie expires from the users browser.

``` ruby
cookies.signed.expires[:user_id] = { :value => 137, :expires => 1.week.from_now }
cookies.signed.expires[:user_id] # => 137
```

The same browser expiry value is baked into the cookie value, signed and verified on read. Obvious this requires the cookie be signed or encrypted or else you could easy forge whatever expiry time. So you'll need to chain it with the existing signed or encrypted jars.

I'm still really unsure about the name. *"expire"*, *"expires"*, *"expiry"*, etc. The idea it is enforces the expire time. Any suggestions? Was hoping @dhh could wordsmith it.

/cc @dhh @josevalim @trevorturk @mastahyeti‎ @spastorino