Rails 7.0 update (#25668)
parent
8bc36b5084
commit
5cdc196e44
@ -0,0 +1,21 @@
|
||||
# frozen_string_literal: true
|
||||
|
||||
Rails.application.config.after_initialize do
|
||||
Rails.application.config.action_dispatch.cookies_rotations.tap do |cookies|
|
||||
authenticated_encrypted_cookie_salt = Rails.application.config.action_dispatch.authenticated_encrypted_cookie_salt
|
||||
signed_cookie_salt = Rails.application.config.action_dispatch.signed_cookie_salt
|
||||
|
||||
secret_key_base = Rails.application.secret_key_base
|
||||
|
||||
key_generator = ActiveSupport::KeyGenerator.new(
|
||||
secret_key_base, iterations: 1000, hash_digest_class: OpenSSL::Digest::SHA1
|
||||
)
|
||||
key_len = ActiveSupport::MessageEncryptor.key_len
|
||||
|
||||
old_encrypted_secret = key_generator.generate_key(authenticated_encrypted_cookie_salt, key_len)
|
||||
old_signed_secret = key_generator.generate_key(signed_cookie_salt)
|
||||
|
||||
cookies.rotate :encrypted, old_encrypted_secret
|
||||
cookies.rotate :signed, old_signed_secret
|
||||
end
|
||||
end
|
@ -0,0 +1,10 @@
|
||||
# frozen_string_literal: true
|
||||
|
||||
# TODO
|
||||
# The Rails 7.0 framework default here is to set this true. However, we have a
|
||||
# location in devise that redirects where we don't have an easy ability to
|
||||
# override a method or set a config option, but where the redirect does not
|
||||
# provide this option.
|
||||
# https://github.com/heartcombo/devise/blob/v4.9.2/app/controllers/devise/confirmations_controller.rb#L28
|
||||
# Once a solution is found, this line can be removed.
|
||||
Rails.application.config.action_controller.raise_on_open_redirects = false
|
Loading…
Reference in new issue