All ActionPack and Railties tests are passing. Closes #8891.

[Carlos Antonio da Silva + Santiago Pastorino]

In the current router DSL, using the +match+ DSL
method will match all verbs for the path to the
specified endpoint.

In the vast majority of cases, people are
currently using +match+ when they actually mean
+get+. This introduces security implications.

This commit disallows calling +match+ without
an HTTP verb constraint by default. To explicitly
match all verbs, this commit also adds a
:via => :all option to +match+.

Closes #5964

The options argument to MessageVerifier#initialize should be a hash.

Replace references to ActiveSupport::SecureRandom with just SecureRandom, and require 'securerandom' from the stdlib when active support is required.

This removes all deprecated classes in ActionController related to
Routing, Abstract Request/Response and Integration/IntegrationTest.
All tests and docs were changed to ActionDispatch instead of ActionController.

Signed-off-by: NJeremy Kemper <jeremy@bitsweat.net>

Fixed that an ArgumentError is thrown when request.session_options[:id] is read in the following scenario: when the cookie store is used, and the session contains a serialized object of an unloaded class, and no session data accesses have occurred yet. Pushed the stale_session_check responsibility out of the SessionHash and down into the session store, closer to where the deserialization actually occurs. Added some test coverage for this case and others related to deserialization of unloaded types.

[#4938]
Signed-off-by: NJosé Valim <jose.valim@gmail.com>

Avoid deserializing cookies too early, which causes session objects to not be available yet. Unfortunately, could not reproduce this in a test case.

[#4938]
Signed-off-by: NJeremy Kemper <jeremy@bitsweat.net>

Add support for multi-subdomain session by setting cookie host in session cookie so you can share session between www.example.com, example.com and user.example.com. [#4818 state:resolved]

This reverts commit 330a8907.

Revert "Add support for multi-subdomain session by setting cookie host in session cookie so you can share session between www.example.com, example.com and user.example.com. [#4818 state:resolved]"

It does not work for domains like co.uk and com.br.

This reverts commit c4d6245e.

Add support for multi-subdomain session by setting cookie host in session cookie so you can share session between www.example.com, example.com and user.example.com. [#4818 state:resolved]
Signed-off-by: NDavid Heinemeier Hansson <david@loudthinking.com>

Cut the fat and make session stores rely on request.cookie_jar and change set_session semantics to return the cookie value instead of a boolean.

with_routing. This only affects our internal AP tests.

If session_options[:id] is requested when using CookieStore, unmarshal the session to access it [#2268 state:resolved]
Signed-off-by: NJoshua Peek <josh@joshpeek.com>

Inherit TestSession from Session::AbstractStore and add indifferent access to Session::AbstractStore.