rails compatibility

[cconstantin]

I did a bit of work on getting plug to correctly decrypt the rails session cookies. Here are the differences between plug and rails:

• MessageEncryptor fails if salt size if higher than 32 bytes. Ruby/OpenSSL trims the key to 32 bytes.
• MessageEncryptor uses a custom padding scheme, while rails/openssl uses PKCS7 padding.
• MessageVerifier uses base64 encoding for digest, while rails uses base16.
• Plug does not encode the cookie name or value, however rack encodes both name and value https://github.com/rack/rack/blob/master/lib/rack/utils.rb#L303

All but first are breaking changes. Rails compatibility is probably not a goal for plug, and it shouldn't be, but it would definitely make the migration path easier to be able to interoperate with rails.

Do you think it makes sense to make these changes in plug?

I have made the changes on a fork, and validated that I can decode/encode rails session cookies:
https://github.com/cconstantin/plug/commits/rails-compat

Cheers

[cconstantin]

Any thoughts on this? I'm getting close to a prod release of my app and I was hoping to create a rails_session plug before that, containing the changes that didn't make sense to include in plug.

[josevalim]

Thanks for all the proposals. I agree making it deserialize Rails stuff is a goal per se but we are definitely making Plug more robust with those changes. I think at the end you will likely need a custom store, even because those defaults changes with Rails versions in Rails too. :)

[cconstantin]

Thanks @josevalim. I'll include the rest into a custom session store (the base16 rails encoding for digest and the encoding of the cookie name and value).

[guilleiguaran]

@cconstantin and please publish it on github <3

[cconstantin]

@guilleiguaran it will be on hex

[cconstantin]

For reference until I find the time to package this and submit to hex https://github.com/cconstantin/plug/tree/rails-session has the two changes needed to decode rails session cookies.

[cconstantin]

Finally got around to publishing a rails compatible cookie store:
https://hex.pm/packages/plug_rails_cookie_session_store