diff --git a/activesupport/CHANGELOG.md b/activesupport/CHANGELOG.md index f5542c6d256e8a4d1af7ef5575bd4a8115848b70..ef46bc06e03ceec24f07833ed8af039d184413d6 100644 --- a/activesupport/CHANGELOG.md +++ b/activesupport/CHANGELOG.md @@ -1,3 +1,31 @@ +* Add purpose and expiry support to `MessageVerifier` & `MessageEncryptor`. + + Messages generated using `MessageVerifier` and `MessageEncryptor` now + support expiry and purpose. You can set the purpose of the message using + the key :purpose, and likewise, the expiration using :expires_at or :expires_in. + + This ensures that the message is used only for its intended purpose and also + while it hasn't expired. + + For instance, to ensure a message is only usable for one intended purpose: + + token = @verifier.generate("x", purpose: :shipping) + + @verifier.verified(token, purpose: :shipping) # => "x" + @verifier.verified(token) # => nil + + Or make it expire after a set time: + + @verifier.generate("x", expires_in: 1.month) + @verifier.generate("y", expires_at: Time.now.end_of_year) + + Showcased with `ActiveSupport::MessageVerifier`, but works the same for + `ActiveSupport::MessageEncryptor`'s `encrypt_and_sign` and `decrypt_and_verify`. + + Pull requests: #29599, #29854 + + *Assain Jaleel* + * Make the order of `Hash#reverse_merge!` consistent with `HashWithIndifferentAccess`. *Erol Fornoles*