Skip to content

v0.2.0

Latest
Latest

Choose a tag to compare

View all tags
@dankimio dankimio released this 25 Sep 13:21
· 14 commits to main since this release
v0.2.0
9fc9646

What's Changed

  • BREAKING: Only support namespaced Rails credentials under codeword (e.g. codeword.codeword, codeword.hint, codeword.cookie_lifetime_in_weeks)

  • BREAKING: Drop support for Rails < 7.2

  • BREAKING: Rename check_for_codeword to require_codeword!

  • BREAKING: Deprecate Rails secrets in favor of Rails credentials

  • BREAKING: Remove lowercase ENV variable support (only uppercase ENV variables are now supported)

  • Prevent open redirects by using allow_other_host: false

  • Harden cookie with httponly: true, same_site: :lax, and secure: request.ssl?

  • codeword_cookie_lifetime now returns an ActiveSupport::Duration; cookie expiry uses from_now

  • Updated crawler detection regex (removed duplicate spider and generic click token)

Migration: see UPGRADE-0.2.md for steps to upgrade from 0.1.x to 0.2.0.

Full Changelog: v0.1.1...v0.2.0

Assets 2
Loading