Use authenticated cookie options to disable embedding of the expiry information in the cookies #32141

rafaelfranca · 2018-02-28T23:18:38Z

We were generating the cookie value with the expiration embedded what makes the value impossible to be read by a Rails 5.1 application.

This option is only useful if you need to share your cookies between a Rails 5.1 and a Rails 5.2 application, or if you are still validating the deploy and wants to eventually rollback.

rails-bot · 2018-02-28T23:18:39Z

Warning

Pull requests are usually filed against the master branch for this repo, but this one is against 5-2-stable. Please double check that you specified the right target!

eugeneius · 2018-03-01T01:16:44Z

...ib/rails/generators/rails/app/templates/config/initializers/new_framework_defaults_5_2.rb.tt

+# Embeds the experity of a cookie inside its value.
+# This makes the cookie value incompatible with Rails < 5.2 so set to false if your
+# cookie needs to be read by a Rails < 5.2 application.
+# Rails.application.config.action_dispatch.embed_expirity_in_the_cookie_value = true


I don't think expirity is a real word 😬

Maybe use_embedded_cookie_expiration?

I'd go with embed_expiry_in_signed_and_encrypted_cookies. Or use_authenticated_encryption_and_embed_expiry_for_cookies if we're unifying with use_authenticated_cookie_encryption.

kaspth · 2018-03-01T20:25:07Z

guides/source/upgrading_ruby_on_rails.md

+
+To improve security, Rails now embeds the expirity information also in encrypted or signed cookies value.
+
+This new embded informaiton make those cookies incompatible with versions of Rails older than 5.2.


information

kaspth · 2018-03-01T20:25:58Z

guides/source/upgrading_ruby_on_rails.md

+This new embded informaiton make those cookies incompatible with versions of Rails older than 5.2.
+
+If you require your cookies to be read by 5.1 and older, set
+`Rails.application.config.action_dispatch.embed_expirity_in_the_cookie_value` to `false`.


Might want to suggest that it's useful for when you're validating your 5.2 deploy and allows you to rollback.

kaspth · 2018-03-01T20:29:57Z

...ib/rails/generators/rails/app/templates/config/initializers/new_framework_defaults_5_2.rb.tt

@@ -14,6 +14,11 @@
 # Existing cookies will be converted on read then written with the new scheme.
 # Rails.application.config.action_dispatch.use_authenticated_cookie_encryption = true


While we're here we may as well say that this also breaks cookie backwards compatibility with 5.1.

We could also consider unifying the 2 options into one. Or just read use_authenticated_cookie_encryption as embed the expiry.

Yeah. I'll use use_authenticated_cookie_encryption for both configs.

kaspth · 2018-03-01T20:33:22Z

...ib/rails/generators/rails/app/templates/config/initializers/new_framework_defaults_5_2.rb.tt

@@ -14,6 +14,11 @@
 # Existing cookies will be converted on read then written with the new scheme.
 # Rails.application.config.action_dispatch.use_authenticated_cookie_encryption = true

+# Embeds the experity of a cookie inside its value.
+# This makes the cookie value incompatible with Rails < 5.2 so set to false if your
+# cookie needs to be read by a Rails < 5.2 application.


I'd say:

# Embed cookie expiry in signed or encrypted cookies for increased security. # This option is not backwards compatible with earlier Rails versions. # It's best enabled when your entire app is migrated and stable on 5.2.

kaspth · 2018-03-01T20:35:26Z

...ib/rails/generators/rails/app/templates/config/initializers/new_framework_defaults_5_2.rb.tt

+# Embeds the experity of a cookie inside its value.
+# This makes the cookie value incompatible with Rails < 5.2 so set to false if your
+# cookie needs to be read by a Rails < 5.2 application.
+# Rails.application.config.action_dispatch.embed_expirity_in_the_cookie_value = true


I'd go with embed_expiry_in_signed_and_encrypted_cookies. Or use_authenticated_encryption_and_embed_expiry_for_cookies if we're unifying with use_authenticated_cookie_encryption.

kaspth · 2018-03-01T20:36:50Z

actionpack/lib/action_dispatch/railtie.rb

@@ -22,6 +22,7 @@ class Railtie < Rails::Railtie # :nodoc:
    config.action_dispatch.authenticated_encrypted_cookie_salt = "authenticated encrypted cookie"
    config.action_dispatch.use_authenticated_cookie_encryption = false
    config.action_dispatch.perform_deep_munge = true
+    config.action_dispatch.embed_expirity_in_the_cookie_value = true


Shouldn't this be set to true in load_defaults instead? Otherwise upgrading apps will still break because of the commented out value in new_framework_defaults.

kaspth

Documentation nits. We can always handle those separately if you want.

kaspth · 2018-03-06T18:42:41Z

guides/source/configuring.md

@@ -502,6 +502,10 @@ Defaults to `'signed cookie'`.
 * `config.action_dispatch.cookies_rotations` allows rotating
  secrets, ciphers, and digests for encrypted and signed cookies.

+* `config.action_dispatch.use_authenticated_cookie_encryption` controls encrypted cookies to use AES-256-GC
+  authenticated encryption and if signed and excrypted cookies are going to embed the expirition information


kaspth · 2018-03-06T18:43:31Z

guides/source/upgrading_ruby_on_rails.md

@@ -76,6 +76,17 @@ Rails 5.2 adds bootsnap gem in the [newly generated app's Gemfile](https://githu
 The `app:update` task sets it up in `boot.rb`. If you want to use it, then add it in the Gemfile,
 otherwise change the `boot.rb` to not use bootsnap.

+### Expirity is now embedded in the cookies values


Expiry … in signed or encrypted cookies. It's only those cookies that get it embedded.

kaspth · 2018-03-06T18:45:33Z

...ib/rails/generators/rails/app/templates/config/initializers/new_framework_defaults_5_2.rb.tt

 # Existing cookies will be converted on read then written with the new scheme.
 # Rails.application.config.action_dispatch.use_authenticated_cookie_encryption = true

+# Rails.application.config.action_dispatch.embed_expirity_in_the_cookie_value = true


This comment line isn't needed.

kaspth · 2018-03-06T18:46:14Z

guides/source/upgrading_ruby_on_rails.md

+
+To improve security, Rails now embeds the expirity information also in encrypted or signed cookies value.
+
+This new embded information make those cookies incompatible with versions of Rails older than 5.2.


kaspth · 2018-03-06T18:46:46Z

guides/source/upgrading_ruby_on_rails.md

@@ -76,6 +76,17 @@ Rails 5.2 adds bootsnap gem in the [newly generated app's Gemfile](https://githu
 The `app:update` task sets it up in `boot.rb`. If you want to use it, then add it in the Gemfile,
 otherwise change the `boot.rb` to not use bootsnap.

+### Expirity is now embedded in the cookies values
+
+To improve security, Rails now embeds the expirity information also in encrypted or signed cookies value.


kaspth · 2018-03-06T18:46:58Z

guides/source/upgrading_ruby_on_rails.md

+
+This new embded information make those cookies incompatible with versions of Rails older than 5.2.
+
+If you require your cookies to be read by 5.1 and older, or you are still validating your 5.2 deploy and wants


…on in the cookies We were generating the cookie value with the expiry information embedded what makes the value impossible to be read by a Rails 5.1 application. This option is only useful if you need to share your cookies between a Rails 5.1 and a Rails 5.2 application, or if you are still validating the deploy and wants to eventually rollback.

rafaelfranca added actionpack railties labels Feb 28, 2018

rafaelfranca added this to the 5.2.0 milestone Feb 28, 2018

rafaelfranca requested a review from kaspth February 28, 2018 23:18

eugeneius reviewed Mar 1, 2018

View reviewed changes

kaspth reviewed Mar 1, 2018

View reviewed changes

dhh assigned kaspth Mar 6, 2018

rafaelfranca force-pushed the rm-configure-embedded-expirity branch from 02f0e76 to aba8fc8 Compare March 6, 2018 18:40

rafaelfranca changed the title ~~Add option to disable embedding of the expirity information in the cookies~~ Use authenticated cookie options to disable embedding of the expiration in the cookies Mar 6, 2018

kaspth approved these changes Mar 6, 2018

View reviewed changes

rafaelfranca force-pushed the rm-configure-embedded-expirity branch from aba8fc8 to b25fcbc Compare March 6, 2018 18:52

rafaelfranca changed the title ~~Use authenticated cookie options to disable embedding of the expiration in the cookies~~ Use authenticated cookie options to disable embedding of the expiry information in the cookies Mar 6, 2018

rafaelfranca merged commit 327bac7 into rails:5-2-stable Mar 6, 2018

rafaelfranca deleted the rm-configure-embedded-expirity branch March 6, 2018 20:19

rafaelfranca restored the rm-configure-embedded-expirity branch September 11, 2020 21:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Use authenticated cookie options to disable embedding of the expiry information in the cookies #32141

Use authenticated cookie options to disable embedding of the expiry information in the cookies #32141

rafaelfranca commented Feb 28, 2018 •

edited

rails-bot commented Feb 28, 2018

eugeneius Mar 1, 2018

kaspth Mar 1, 2018

kaspth Mar 1, 2018

kaspth Mar 1, 2018

kaspth Mar 1, 2018

rafaelfranca Mar 6, 2018

kaspth Mar 1, 2018

kaspth Mar 1, 2018

kaspth Mar 1, 2018

kaspth left a comment

kaspth Mar 6, 2018

kaspth Mar 6, 2018

kaspth Mar 6, 2018

kaspth Mar 6, 2018

kaspth Mar 6, 2018

kaspth Mar 6, 2018


		To improve security, Rails now embeds the expirity information also in encrypted or signed cookies value.

		This new embded informaiton make those cookies incompatible with versions of Rails older than 5.2.

		@@ -14,6 +14,11 @@
		# Existing cookies will be converted on read then written with the new scheme.
		# Rails.application.config.action_dispatch.use_authenticated_cookie_encryption = true


		To improve security, Rails now embeds the expirity information also in encrypted or signed cookies value.

		This new embded information make those cookies incompatible with versions of Rails older than 5.2.


		This new embded information make those cookies incompatible with versions of Rails older than 5.2.

		If you require your cookies to be read by 5.1 and older, or you are still validating your 5.2 deploy and wants

Use authenticated cookie options to disable embedding of the expiry information in the cookies #32141

Use authenticated cookie options to disable embedding of the expiry information in the cookies #32141

Conversation

rafaelfranca commented Feb 28, 2018 • edited

rails-bot commented Feb 28, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kaspth left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rafaelfranca commented Feb 28, 2018 •

edited