Merge pull request #33757 from bogdanvlviv/follow-up-32937

Follow up #32937 [ci skip]

2 files changed, 14 insertions, 0 deletions

diff --git a/guides/source/configuring.md b/guides/source/configuring.md
index b20a2bb0d2..7265d1e05f 100644
--- a/guides/source/configuring.md
+++ b/guides/source/configuring.md
@@ -516,6 +516,9 @@ Defaults to `'signed cookie'`.
   signed and encrypted cookies use the AES-256-GCM cipher or
   the older AES-256-CBC cipher. It defaults to `true`.
 
+* `config.action_dispatch.use_cookies_with_metadata` enables writing
+  cookies with the purpose and expiry metadata embedded. It defaults to `true`.
+
 * `config.action_dispatch.perform_deep_munge` configures whether `deep_munge`
   method should be performed on the parameters. See [Security Guide](security.html#unsafe-query-generation)
   for more information. It defaults to `true`.
diff --git a/guides/source/upgrading_ruby_on_rails.md b/guides/source/upgrading_ruby_on_rails.md
index 3f8edd953d..befd4e08c0 100644
--- a/guides/source/upgrading_ruby_on_rails.md
+++ b/guides/source/upgrading_ruby_on_rails.md
@@ -85,6 +85,17 @@ Rails 6.1. You are encouraged to enable `config.force_ssl` to enforce HTTPS
 connections throughout your application. If you need to exempt certain endpoints
 from redirection, you can use `config.ssl_options` to configure that behavior.
 
+### Purpose in signed or encrypted cookie is now embedded in the cookies values
+
+To improve security, Rails now embeds the purpose information in encrypted or signed cookies value.
+Rails can now thwart attacks that attempt to copy signed/encrypted value
+of a cookie and use it as the value of another cookie.
+
+This new embed information make those cookies incompatible with versions of Rails older than 6.0.
+
+If you require your cookies to be read by 5.2 and older, or you are still validating your 6.0 deploy and want
+to allow you to rollback set
+`Rails.application.config.action_dispatch.use_cookies_with_metadata` to `false`.
 
 Upgrading from Rails 5.1 to Rails 5.2
 -------------------------------------