Skip to content

Commit

Permalink
Remove suggestion that Procs can be used as session secrets.
Browse files Browse the repository at this point in the history
(cherry picked from commit 6500d79)

[ci skip]

Signed-off-by: Andrew White <andyw@pixeltrix.co.uk>
  • Loading branch information
jcoglan authored and pixeltrix committed Jan 5, 2013
1 parent 665e11e commit 1506d4d
Showing 1 changed file with 4 additions and 7 deletions.
Expand Up @@ -22,15 +22,12 @@ module Session
# #
# Session options: # Session options:
# #
# * <tt>:secret</tt>: An application-wide key string or block returning a # * <tt>:secret</tt>: An application-wide key string. It's important that
# string called per generated digest. The block is called with the # the secret is not vulnerable to a dictionary attack. Therefore, you
# CGI::Session instance as an argument. It's important that the secret # should choose a secret consisting of random numbers and letters and
# is not vulnerable to a dictionary attack. Therefore, you should choose # more than 30 characters.
# a secret consisting of random numbers and letters and more than 30
# characters. Examples:
# #
# :secret => '449fe2e7daee471bffae2fd8dc02313d' # :secret => '449fe2e7daee471bffae2fd8dc02313d'
# :secret => Proc.new { User.current_user.secret_key }
# #
# * <tt>:digest</tt>: The message digest algorithm used to verify session # * <tt>:digest</tt>: The message digest algorithm used to verify session
# integrity defaults to 'SHA1' but may be any digest provided by OpenSSL, # integrity defaults to 'SHA1' but may be any digest provided by OpenSSL,
Expand Down

0 comments on commit 1506d4d

Please sign in to comment.