DGNum/demarches-normaliennes
14
1
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity

chore: rotate cookies with SHA256 hash

Browse source
This commit is contained in:
Colin Darie 2024-08-21 16:22:41 +02:00
parent ced61b4613
commit 98ff68f923
No known key found for this signature in database
GPG key ID: 4FB865FDBCA4BCC4
2 changed files with 21 additions and 17 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

36
config/initializers/cookie_rotator.rb
View file

@ -1,20 +1,24 @@
# frozen_string_literal: true
# TODO: Enable cookies rotation when new SHA256 will be enforced
# See new_framework_defaults_7.0.rb
# key_generator_hash_digest_class = OpenSSL::Digest::SHA256 will be
#
# Rails.application.config.after_initialize do
# Rails.application.config.action_dispatch.cookies_rotations.tap do |cookies|
# salt = Rails.application.config.action_dispatch.authenticated_encrypted_cookie_salt
# secret_key_base = Rails.application.secret_key_base
# This cookie rotator converts cookies from the old SHA1 hash (Rails 6) to SHA256 hash (Rails 7 default).
# It should be kept enabled for approximately 1 month to ensure most users have their cookies rotated.
# After this period, it can be safely removed.
# Without this rotator, all users would have been signed out.
Rails.application.config.after_initialize do
Rails.application.config.action_dispatch.cookies_rotations.tap do |cookies|
authenticated_encrypted_cookie_salt = Rails.application.config.action_dispatch.authenticated_encrypted_cookie_salt
signed_cookie_salt = Rails.application.config.action_dispatch.signed_cookie_salt
secret_key_base = Rails.application.secret_key_base
# key_generator = ActiveSupport::KeyGenerator.new(
# secret_key_base, iterations: 1000, hash_digest_class: OpenSSL::Digest::SHA1
# )
# key_len = ActiveSupport::MessageEncryptor.key_len
# secret = key_generator.generate_key(salt, key_len)
key_generator = ActiveSupport::KeyGenerator.new(
secret_key_base, iterations: 1000, hash_digest_class: OpenSSL::Digest::SHA1 # Rails 6 hash
)
key_len = ActiveSupport::MessageEncryptor.key_len
# cookies.rotate :encrypted, secret
# end
# end
old_encrypted_secret = key_generator.generate_key(authenticated_encrypted_cookie_salt, key_len)
old_signed_secret = key_generator.generate_key(signed_cookie_salt)
cookies.rotate :encrypted, old_encrypted_secret
cookies.rotate :signed, old_signed_secret
end
end

2
config/initializers/new_framework_defaults_7_0.rb
View file

@ -25,7 +25,7 @@ Rails.application.config.action_view.apply_stylesheet_media_default = false
#
# See upgrading guide for more information on how to build a rotator.
# https://guides.rubyonrails.org/v7.0/upgrading_ruby_on_rails.html
# Rails.application.config.active_support.key_generator_hash_digest_class = OpenSSL::Digest::SHA256
Rails.application.config.active_support.key_generator_hash_digest_class = OpenSSL::Digest::SHA256
# Change the digest class for ActiveSupport::Digest.
# Changing this default means that for example Etags change and