-
Notifications
You must be signed in to change notification settings - Fork 20
Renders a security warning on every request #158
Comments
Yeah, I can see where Rack is coming from here, but this one is super annoying :/ Any thoughts on what we should do to solve it? We could just include a signature as well, but it seems somewhat wasteful just to bypass and error message which is being wrongly injected. We could also see if we can get an upstream patch into Rack. |
I looked into just supplying the signature but it will encode it twice :/ |
Opened a PR on Rack to allow disabling of the warning for cases like these: rack/rack#900 |
👍 |
@dmcinnes Nice :) |
The rack PR has been merged! Once a Rack release is made we can update to fix this. |
Around Rack 1.5.2 a warning message was added if
Rack::Session::Cookie
does not have thesecret
option set:https://github.com/rack/rack/blob/master/lib/rack/session/cookie.rb#L108-L116
Identity is now seeing this in the logs:
Though annoying, it can be safely ignored because Identity supplies
FernetCookieCoder
as the session cookie coder which handles the encryption piece.Unfortunately there is no easy way to disable the warning short of disabling all warnings in rack.
The text was updated successfully, but these errors were encountered: