Rename config.cookie_secret to config.secret_token and pass it as configuration in request.env. This is another step forward removing global configuration.

1 files changed, 16 insertions, 0 deletions

diff --git a/railties/test/application/configuration_test.rb b/railties/test/application/configuration_test.rb
index 68ca2acaad..90f2e2b370 100644
--- a/railties/test/application/configuration_test.rb
+++ b/railties/test/application/configuration_test.rb
@@ -234,6 +234,22 @@ module ApplicationTests
       assert_equal File.expand_path(__FILE__), last_response.headers["X-Lighttpd-Send-File"]
     end
 
+    test "config.secret_token is sent in env" do
+      make_basic_app do |app|
+        app.config.secret_token = 'ThisIsASECRET123'
+      end
+
+      class ::OmgController < ActionController::Base
+        def index
+          cookies.signed[:some_key] = "some_value"
+          render :text => env["action_dispatch.secret_token"]
+        end
+      end
+
+      get "/"
+      assert_equal 'ThisIsASECRET123', last_response.body
+    end
+
     test "protect from forgery is the default in a new app" do
       make_basic_app