diff options
| author | James Coglan <jcoglan@gmail.com> | 2013-01-05 14:52:02 +0000 |
|---|---|---|
| committer | Andrew White <andyw@pixeltrix.co.uk> | 2013-01-05 18:39:16 +0000 |
| commit | 1506d4d9e4fcf7abb94574bf8d0d58672b04a736 (patch) | |
| tree | 0b061f5780893d1c902a772ca752945a58741c6e | |
| parent | 665e11e53956269e81eacd5b0dfeebd4aef789b7 (diff) | |
| download | rails-1506d4d9e4fcf7abb94574bf8d0d58672b04a736.tar.gz rails-1506d4d9e4fcf7abb94574bf8d0d58672b04a736.tar.bz2 rails-1506d4d9e4fcf7abb94574bf8d0d58672b04a736.zip | |
Remove suggestion that Procs can be used as session secrets.
(cherry picked from commit 6500d7994e94af439587ba0b6088b14532940ad2)
[ci skip]
Signed-off-by: Andrew White <andyw@pixeltrix.co.uk>
| -rw-r--r-- | actionpack/lib/action_dispatch/middleware/session/cookie_store.rb | 11 |
1 files changed, 4 insertions, 7 deletions
diff --git a/actionpack/lib/action_dispatch/middleware/session/cookie_store.rb b/actionpack/lib/action_dispatch/middleware/session/cookie_store.rb index 29e9e6c261..80c596fd51 100644 --- a/actionpack/lib/action_dispatch/middleware/session/cookie_store.rb +++ b/actionpack/lib/action_dispatch/middleware/session/cookie_store.rb @@ -22,15 +22,12 @@ module ActionDispatch # # Session options: # - # * <tt>:secret</tt>: An application-wide key string or block returning a - # string called per generated digest. The block is called with the - # CGI::Session instance as an argument. It's important that the secret - # is not vulnerable to a dictionary attack. Therefore, you should choose - # a secret consisting of random numbers and letters and more than 30 - # characters. Examples: + # * <tt>:secret</tt>: An application-wide key string. It's important that + # the secret is not vulnerable to a dictionary attack. Therefore, you + # should choose a secret consisting of random numbers and letters and + # more than 30 characters. # # :secret => '449fe2e7daee471bffae2fd8dc02313d' - # :secret => Proc.new { User.current_user.secret_key } # # * <tt>:digest</tt>: The message digest algorithm used to verify session # integrity defaults to 'SHA1' but may be any digest provided by OpenSSL, |