Graceful secret key rotation for the signed cookie store in Rails.
Ruby
Latest commit d470f92 Sep 24, 2014 @mariovisic mariovisic Bump to version 0.0.3
Permalink
Failed to load latest commit information.
lib
test
.gitignore
Gemfile
LICENSE.txt
README.md
Rakefile
rails_session_key_rotator.gemspec

README.md

RailsSessionKeyRotator

Graceful secret key rotation for the signed cookie store in Rails. Use this when you'd rather not sign everyone out to rotate your session secret.

This gem provides a Rack middleware which will regenerate the session cookie with one generated by the new secret if it was written with the old secret. This way we don't have to monkey patch Rails internals and Rails only has to know about the new session key.

Installation

Add this line to your application's Gemfile:

gem 'rails_session_key_rotator'

And then execute:

$ bundle

Usage

In config/application.rb:

config.middleware.insert_before(ActionDispatch::Session::CookieStore, RailsSessionKeyRotator,
                               :old_secret => Secrets.old_session_secret,
                               :new_secret => Secrets.session_secret,
                               :key => 'myapp_session')

Contributing

  1. Fork it ( http://github.com/envato/rails_session_key_rotator/fork )
  2. Create your feature branch (git checkout -b my-new-feature)
  3. Commit your changes (git commit -am 'Add some feature')
  4. Push to the branch (git push origin my-new-feature)
  5. Create new Pull Request