rails/CHANGELOG.md at 5a3ba63d9abad86b7f6dd36a92cfaf722e52760b

Michael Coyne 5a3ba63d9a AEAD encrypted cookies and sessions

This commit changes encrypted cookies from AES in CBC HMAC mode to
Authenticated Encryption using AES-GCM. It also provides a cookie jar
to transparently upgrade encrypted cookies to this new scheme. Some
other notable changes include:

- There is a new application configuration value:
  +use_authenticated_cookie_encryption+. When enabled, AEAD encrypted
  cookies will be used.

- +cookies.signed+ does not raise a +TypeError+ now if the name of an
  encrypted cookie is used. Encrypted cookies using the same key as
  signed cookies would be verified and serialization would then fail
  due the message still be encrypted.

2017-05-22 08:50:36 +00:00

1.6 KiB

Raw Blame History

AEAD encrypted cookies and sessions with GCM

Encrypted cookies now use AES-GCM which couples authentication and encryption in one faster step and produces shorter ciphertexts. Cookies encrypted using AES in CBC HMAC mode will be seamlessly upgraded when this new mode is enabled via the action_dispatch.use_authenticated_cookie_encryption configuration value.

Michael J Coyne

Change the cache key format for fragments to make it easier to debug key churn. The new format is:

views/template/action.html.erb:7a1156131a6928cb0026877f8b749ac9/projects/123
      ^template path           ^template tree digest            ^class   ^id

DHH

Add support for recyclable cache keys with fragment caching. This uses the new versioned entries in the ActiveSupport::Cache stores and relies on the fact that Active Record has split #cache_key and #cache_version to support it.

DHH
Add action_controller_api and action_controller_base load hooks to be called in ActiveSupport.on_load

ActionController::Base and ActionController::API have differing implementations. This means that the one umbrella hook action_controller is not able to address certain situations where a method may not exist in a certain implementation.

This is fixed by adding two new hooks so you can target ActionController::Base vs ActionController::API

Fixes #27013.

Julian Nadeau

Please check 5-1-stable for previous changes.

1.6 KiB Raw Blame History

1.6 KiB

Raw Blame History