monorail
/
mastodon
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Change default KeyGenerator digest to SHA1 to fix cookies in rolling upgrades (#26023)

This commit is contained in:
Claire 2023-07-21 13:17:43 +02:00 committed by GitHub
parent e4ea80d808
commit 934c7b33d1
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
config/initializers/cookie_rotator.rb
View File

@ -1,5 +1,10 @@
# frozen_string_literal: true
# TODO: Remove after 4.2.0
Rails.application.configure do
config.active_support.key_generator_hash_digest_class = OpenSSL::Digest::SHA1
end
Rails.application.config.after_initialize do
Rails.application.config.action_dispatch.cookies_rotations.tap do |cookies|
authenticated_encrypted_cookie_salt = Rails.application.config.action_dispatch.authenticated_encrypted_cookie_salt
@ -7,8 +12,9 @@ Rails.application.config.after_initialize do
secret_key_base = Rails.application.secret_key_base
# TODO: Switch to SHA1 after 4.2.0
key_generator = ActiveSupport::KeyGenerator.new(
secret_key_base, iterations: 1000, hash_digest_class: OpenSSL::Digest::SHA1
secret_key_base, iterations: 1000, hash_digest_class: OpenSSL::Digest::SHA256
)
key_len = ActiveSupport::MessageEncryptor.key_len