This project is archived and is in readonly mode.
Rails::SecretKeyGenerator should be removed in favor of SecureRandom
Rails::SecretKeyGenerator is used for generating a secret key for the session cookie store. Ruby 1.9's SecureRandom library actually do the same thing, but slightly better. For example, SecureRandom's /dev/urandom implementation checks whether /dev/urandom is a block device and not a symlink, and opens it O_NCTTY so that it doesn't become the process's controlling terminal. Plus, SecureRandom favors OpenSSL, which is much faster than /dev/urandom. SecretKeyGenerator favors /dev/urandom.
The attached patch removes Rails::SecretKeyGenerator and replaces it with ActiveSupport::SecureRandom.
-
Hongli Lai- Title changed from Rails::SecretKeyGenerator should be removed in factor of SecureRandom to Rails::SecretKeyGenerator should be removed in favor of SecureRandom
- Tag changed from activesupport, edge to activesupport, edge, patch
-
Hongli Lai
Updated patch: Rails::SecretKeyGenerator is now a lightweight compatibility wrapper around ActiveSupport::SecureRandom.
-
Repository
- State changed from new to committed
(from [b3411ff59eb1e1c31f98f58f117a2ffaaf0c3ff5]) Deprecate Rails::SecretKeyGenerator in favor of ActiveSupport::SecureRandom.
SecureRandom has a few minor security enhancements and can be used as a drop-in replacement
Signed-off-by: Michael Koziarski michael@koziarski.com [#913 Rails::SecretKeyGenerator should be removed in favor of SecureRandom state:committed] http://github.com/rails/rails/co...