Class: Rack::Session::Cookie

Inherits:
Abstract::ID show all
Defined in:
rack/rack/session/cookie.rb

Overview

Rack::Session::Cookie provides simple cookie based session management. By default, the session is a Ruby Hash stored as base64 encoded marshalled data set to :key (default: rack.session). The object that encodes the session data is configurable and must respond to encode and decode. Both methods must take a string and return a string.

When the secret key is set, cookie data is checked for data integrity. The old secret key is also accepted and allows graceful secret rotation.

Example:

use Rack::Session::Cookie, :key => 'rack.session',
                           :domain => 'foo.com',
                           :path => '/',
                           :expire_after => 2592000,
                           :secret => 'change_me',
                           :old_secret => 'also_change_me'

All parameters are optional.

Example of a cookie with no encoding:

Rack::Session::Cookie.new(application, { :coder => Rack::Session::Cookie::Identity.new })

Example of a cookie with custom encoding:

Rack::Session::Cookie.new(application, { :coder => Class.new { def encode(str); str.reverse; end def decode(str); str.reverse; end }.new })

Defined Under Namespace

Classes: Base64, Identity, Reverse

Constant Summary

Instance Attribute Summary (collapse)

Instance Method Summary (collapse)

Constructor Details

- (Cookie) initialize(app, options = {})

Returns a new instance of Cookie



97
98
99
100
101
102
103
104
105
106
107
108
109
110
 
# File 'rack/rack/session/cookie.rb', line 97

def initialize(app, options={})
  @secrets = options.values_at(:secret, :old_secret).compact
  warn <<-MSG unless @secrets.size >= 1
  SECURITY WARNING: No secret option provided to Rack::Session::Cookie.
  This poses a security threat. It is strongly recommended that you
  provide a secret to prevent exploits that may be possible from crafted
  cookies. This will not be supported in future versions of Rack, and
  future versions will even invalidate your existing user cookies.

  Called from: #{caller[0]}.
  MSG
  @coder  = options[:coder] ||= Base64::Marshal.new
  super(app, options.merge!(:cookie_only => true))
end

Instance Attribute Details

- (void) coder (readonly)

Returns the value of attribute coder



95
96
97
 
# File 'rack/rack/session/cookie.rb', line 95

def coder
  @coder
end

- (void) default_options (readonly) Originally defined in class Abstract::ID

Returns the value of attribute default_options

- (void) key (readonly) Originally defined in class Abstract::ID

Returns the value of attribute key