Rails 7.0 update (#25668)
parent
8d0c69529a
commit
ce43ed144c
23 changed files with 251 additions and 138 deletions
@ -0,0 +1,21 @@ |
|||||||
|
# frozen_string_literal: true |
||||||
|
|
||||||
|
Rails.application.config.after_initialize do |
||||||
|
Rails.application.config.action_dispatch.cookies_rotations.tap do |cookies| |
||||||
|
authenticated_encrypted_cookie_salt = Rails.application.config.action_dispatch.authenticated_encrypted_cookie_salt |
||||||
|
signed_cookie_salt = Rails.application.config.action_dispatch.signed_cookie_salt |
||||||
|
|
||||||
|
secret_key_base = Rails.application.secret_key_base |
||||||
|
|
||||||
|
key_generator = ActiveSupport::KeyGenerator.new( |
||||||
|
secret_key_base, iterations: 1000, hash_digest_class: OpenSSL::Digest::SHA1 |
||||||
|
) |
||||||
|
key_len = ActiveSupport::MessageEncryptor.key_len |
||||||
|
|
||||||
|
old_encrypted_secret = key_generator.generate_key(authenticated_encrypted_cookie_salt, key_len) |
||||||
|
old_signed_secret = key_generator.generate_key(signed_cookie_salt) |
||||||
|
|
||||||
|
cookies.rotate :encrypted, old_encrypted_secret |
||||||
|
cookies.rotate :signed, old_signed_secret |
||||||
|
end |
||||||
|
end |
@ -0,0 +1,10 @@ |
|||||||
|
# frozen_string_literal: true |
||||||
|
|
||||||
|
# TODO |
||||||
|
# The Rails 7.0 framework default here is to set this true. However, we have a |
||||||
|
# location in devise that redirects where we don't have an easy ability to |
||||||
|
# override a method or set a config option, but where the redirect does not |
||||||
|
# provide this option. |
||||||
|
# https://github.com/heartcombo/devise/blob/v4.9.2/app/controllers/devise/confirmations_controller.rb#L28 |
||||||
|
# Once a solution is found, this line can be removed. |
||||||
|
Rails.application.config.action_controller.raise_on_open_redirects = false |
Loading…
Reference in new issue