aboutsummaryrefslogtreecommitdiffstats
path: root/guides
diff options
context:
space:
mode:
authorVishal Telangre <the@vishaltelangre.com>2019-05-11 20:27:44 +0530
committerVishal Telangre <the@vishaltelangre.com>2019-05-12 18:45:40 +0530
commit739aec916fc95e24d1917383d628dbfde28f1125 (patch)
tree1892f8058b1bef08614c6a1c6397ef53bff656a8 /guides
parente8350663ad7c4bd9f8f724d0e82b2a48f5acfee4 (diff)
downloadrails-739aec916fc95e24d1917383d628dbfde28f1125.tar.gz
rails-739aec916fc95e24d1917383d628dbfde28f1125.tar.bz2
rails-739aec916fc95e24d1917383d628dbfde28f1125.zip
[ci skip] Clarity about embed metadata in signed and encrypted cookie
Diffstat (limited to 'guides')
-rw-r--r--guides/source/6_0_release_notes.md2
-rw-r--r--guides/source/upgrading_ruby_on_rails.md7
2 files changed, 5 insertions, 4 deletions
diff --git a/guides/source/6_0_release_notes.md b/guides/source/6_0_release_notes.md
index cb3ea7737c..6ad00270bb 100644
--- a/guides/source/6_0_release_notes.md
+++ b/guides/source/6_0_release_notes.md
@@ -245,7 +245,7 @@ Please refer to the [Changelog][action-pack] for detailed changes.
* Expose `ActionController::Parameters#each_key`.
([Pull Request](https://github.com/rails/rails/pull/33758))
-* Add purpose metadata to signed/encrypted cookies to prevent copying the value of
+* Add purpose and expiry metadata inside signed/encrypted cookies to prevent copying the value of
cookies into one another.
([Pull Request](https://github.com/rails/rails/pull/32937))
diff --git a/guides/source/upgrading_ruby_on_rails.md b/guides/source/upgrading_ruby_on_rails.md
index 76ee5c0c48..0cdc4e75ba 100644
--- a/guides/source/upgrading_ruby_on_rails.md
+++ b/guides/source/upgrading_ruby_on_rails.md
@@ -85,13 +85,14 @@ Rails 6.1. You are encouraged to enable `config.force_ssl` to enforce HTTPS
connections throughout your application. If you need to exempt certain endpoints
from redirection, you can use `config.ssl_options` to configure that behavior.
-### Purpose in signed or encrypted cookie is now embedded within cookies
+### Purpose and expiry metadata is now embedded inside signed and encrypted cookies for increased security
+
+To improve security, Rails embeds the purpose and expiry metadata inside encrypted or signed cookies value.
-To improve security, Rails embeds the purpose information in encrypted or signed cookies value.
Rails can then thwart attacks that attempt to copy the signed/encrypted value
of a cookie and use it as the value of another cookie.
-This new embed information make those cookies incompatible with versions of Rails older than 6.0.
+This new embed metadata make those cookies incompatible with versions of Rails older than 6.0.
If you require your cookies to be read by Rails 5.2 and older, or you are still validating your 6.0 deploy and want
to be able to rollback set