Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
张重言
rails
提交
86d12313
R
rails
项目概览
张重言
/
rails
通知
1
Star
0
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
R
rails
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
提交
86d12313
编写于
10月 10, 2017
作者:
R
Rafael França
提交者:
GitHub
10月 10, 2017
浏览文件
操作
浏览文件
下载
差异文件
Merge pull request #30847 from mikeycgto/signed-cookie-rotation-updates
Update security guide for signed cookie rotations
上级
ac1ee519
04a7b716
变更
2
隐藏空白更改
内联
并排
Showing
2 changed file
with
22 addition
and
2 deletion
+22
-2
actionpack/test/dispatch/cookies_test.rb
actionpack/test/dispatch/cookies_test.rb
+19
-0
guides/source/security.md
guides/source/security.md
+3
-2
未找到文件。
actionpack/test/dispatch/cookies_test.rb
浏览文件 @
86d12313
...
...
@@ -917,6 +917,25 @@ def test_use_authenticated_cookie_encryption_uses_legacy_hmac_aes_cbc_encryption
assert_equal
"bar"
,
encryptor
.
decrypt_and_verify
(
@response
.
cookies
[
"foo"
])
end
def
test_rotating_signed_cookies_digest
@request
.
env
[
"action_dispatch.signed_cookie_digest"
]
=
"SHA256"
@request
.
env
[
"action_dispatch.cookies_rotations"
].
rotate
:signed
,
digest:
"SHA1"
key_generator
=
@request
.
env
[
"action_dispatch.key_generator"
]
old_secret
=
key_generator
.
generate_key
(
@request
.
env
[
"action_dispatch.signed_cookie_salt"
])
old_value
=
ActiveSupport
::
MessageVerifier
.
new
(
old_secret
).
generate
(
45
)
@request
.
headers
[
"Cookie"
]
=
"user_id=
#{
old_value
}
"
get
:get_signed_cookie
assert_equal
45
,
@controller
.
send
(
:cookies
).
signed
[
:user_id
]
secret
=
key_generator
.
generate_key
(
@request
.
env
[
"action_dispatch.signed_cookie_salt"
])
verifier
=
ActiveSupport
::
MessageVerifier
.
new
(
secret
,
digest:
"SHA256"
)
assert_equal
45
,
verifier
.
verify
(
@response
.
cookies
[
"user_id"
])
end
def
test_legacy_hmac_aes_cbc_encrypted_marshal_cookie_is_upgraded_to_authenticated_encrypted_cookie
key_generator
=
@request
.
env
[
"action_dispatch.key_generator"
]
encrypted_cookie_salt
=
@request
.
env
[
"action_dispatch.encrypted_cookie_salt"
]
...
...
guides/source/security.md
浏览文件 @
86d12313
...
...
@@ -169,11 +169,12 @@ you would first assign the new configuration value:
Rails
.
application
.
config
.
action_dispatch
.
signed_cookie_digest
=
"SHA256"
```
Then you'd set up a rotation with the old configuration to keep it alive.
Now add a rotation for the old SHA1 digest so existing cookies are
seamlessly upgraded to the new SHA256 digest.
```
ruby
Rails
.
application
.
config
.
action_dispatch
.
cookies_rotations
.
tap
do
|
cookies
|
cookies
.
rotate
:signed
,
digest:
"SHA
256
"
cookies
.
rotate
:signed
,
digest:
"SHA
1
"
end
```
...
...
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录