This project is archived and is in readonly mode.
Rails::SecretKeyGenerator should be removed in favor of SecureRandom
Reported by Hongli Lai | August 27th, 2008 @ 11:49 AM | in 2.x
Rails::SecretKeyGenerator is used for generating a secret key for the session cookie store. Ruby 1.9's SecureRandom library actually do the same thing, but slightly better. For example, SecureRandom's /dev/urandom implementation checks whether /dev/urandom is a block device and not a symlink, and opens it O_NCTTY so that it doesn't become the process's controlling terminal. Plus, SecureRandom favors OpenSSL, which is much faster than /dev/urandom. SecretKeyGenerator favors /dev/urandom.
The attached patch removes Rails::SecretKeyGenerator and replaces it with ActiveSupport::SecureRandom.
Comments and changes to this ticket
-
Hongli Lai August 27th, 2008 @ 11:50 AM
- Title changed from “Rails::SecretKeyGenerator should be removed in factor of SecureRandom” to “Rails::SecretKeyGenerator should be removed in favor of SecureRandom”
- Tag changed from “activesupport, edge” to “activesupport, edge, patch”
-
Hongli Lai August 27th, 2008 @ 12:12 PM
Updated patch: Rails::SecretKeyGenerator is now a lightweight compatibility wrapper around ActiveSupport::SecureRandom.
-
Repository August 27th, 2008 @ 02:19 PM
- State changed from “new” to “committed”
(from [b3411ff59eb1e1c31f98f58f117a2ffaaf0c3ff5]) Deprecate Rails::SecretKeyGenerator in favor of ActiveSupport::SecureRandom.
SecureRandom has a few minor security enhancements and can be used as a drop-in replacement
Signed-off-by: Michael Koziarski michael@koziarski.com [#913 state:committed] http://github.com/rails/rails/co...
Create your profile
Help contribute to this project by taking a few moments to create your personal profile. Create your profile »
<h2 style="font-size: 14px">Tickets have moved to Github</h2>
The new ticket tracker is available at <a href="https://github.com/rails/rails/issues">https://github.com/rails/rails/issues</a>
People watching this ticket
Hongli Lai
Attachments
Tags
Referenced by
-
913
Rails::SecretKeyGenerator should be removed in favor of SecureRandom
Signed-off-by: Michael Koziarski michael@koziarski.com
[#...