class ActionDispatch::Cookies::SignedCookieJar
:nodoc:
def [](name)
def [](name) if signed_message = @parent_jar[name] @verifier.verify(signed_message) end rescue ActiveSupport::MessageVerifier::InvalidSignature nil end
def []=(key, options)
def []=(key, options) if options.is_a?(Hash) options.symbolize_keys! options[:value] = @verifier.generate(options[:value]) else options = { :value => @verifier.generate(options) } end raise CookieOverflow if options[:value].size > MAX_COOKIE_SIZE @parent_jar[key] = options end
def ensure_secret_secure(secret)
To prevent users from using something insecure like "Password" we make sure that the
def ensure_secret_secure(secret) if secret.blank? raise ArgumentError, "A secret is required to generate an " + "integrity hash for cookie session data. Use " + "config.secret_token = \"some secret phrase of at " + "least #{SECRET_MIN_LENGTH} characters\"" + "in config/initializers/secret_token.rb" end if secret.length < SECRET_MIN_LENGTH raise ArgumentError, "Secret should be something secure, " + "like \"#{SecureRandom.hex(16)}\". The value you " + "provided, \"#{secret}\", is shorter than the minimum length " + "of #{SECRET_MIN_LENGTH} characters" end end
def initialize(parent_jar, secret)
def initialize(parent_jar, secret) ensure_secret_secure(secret) @parent_jar = parent_jar @verifier = ActiveSupport::MessageVerifier.new(secret) end
def method_missing(method, *arguments, &block)
def method_missing(method, *arguments, &block) @parent_jar.send(method, *arguments, &block) end