From 934c7b33d1d33e3e12a7bb12f654b5d8eed0d51b Mon Sep 17 00:00:00 2001 From: Claire Date: Fri, 21 Jul 2023 13:17:43 +0200 Subject: [PATCH] Change default KeyGenerator digest to SHA1 to fix cookies in rolling upgrades (#26023) --- config/initializers/cookie_rotator.rb | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/config/initializers/cookie_rotator.rb b/config/initializers/cookie_rotator.rb index 349c363f1..b829b1a90 100644 --- a/config/initializers/cookie_rotator.rb +++ b/config/initializers/cookie_rotator.rb @@ -1,5 +1,10 @@ # frozen_string_literal: true +# TODO: Remove after 4.2.0 +Rails.application.configure do + config.active_support.key_generator_hash_digest_class = OpenSSL::Digest::SHA1 +end + Rails.application.config.after_initialize do Rails.application.config.action_dispatch.cookies_rotations.tap do |cookies| authenticated_encrypted_cookie_salt = Rails.application.config.action_dispatch.authenticated_encrypted_cookie_salt @@ -7,8 +12,9 @@ Rails.application.config.after_initialize do secret_key_base = Rails.application.secret_key_base + # TODO: Switch to SHA1 after 4.2.0 key_generator = ActiveSupport::KeyGenerator.new( - secret_key_base, iterations: 1000, hash_digest_class: OpenSSL::Digest::SHA1 + secret_key_base, iterations: 1000, hash_digest_class: OpenSSL::Digest::SHA256 ) key_len = ActiveSupport::MessageEncryptor.key_len