Mislav
December 29, 2009, 1:48pm
1
Rails application generator from current master creates two scripts in “config/initializers/”: “cookie_verifier_secret.rb” and “session_store.rb”.
The former is something like:
ActionController::Base.cookie_verifier_secret = ‘xyz…’
… while the latter is:
ActionController::Base.session = {
:key => ‘_foobar_session’,
:secret => ‘abcdefgh…’
}
How do these two secret keys relate, and why are they generated different?
I'm also wondering about this. Is there a reason that we can't just
generate one secret for use throughout an app in any case where we
need a secret key?
- Trevor
Pratik1
January 3, 2010, 6:11pm
3
Cookie verifier secret is just for the new cookies.signed option -
http://github.com/rails/rails/commit/0200e20f148c96afceeebc4da7b5985643f9f707 .
It has nothing to do with the session secret.