From 6756a8881592999ae073cc07be90282b558d5023 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Javi=20Mart=C3=ADn?= Date: Sat, 5 Sep 2020 18:11:22 +0200 Subject: [PATCH] Enable authenticated cookie encryption This is the default encryption for cookies in Rails 5.2 applications. The reason it isn't enabled automatically for existing applications is these cookies are not compatible with running the application on several servers when some of them use Rails 4. Since this isn't our case (we don't support using different versions of CONSUL on different servers), and existing cookies are still read correctly, we can safely enable it. --- config/initializers/new_framework_defaults_5_2.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/initializers/new_framework_defaults_5_2.rb b/config/initializers/new_framework_defaults_5_2.rb index a8b584561..686b6fd4e 100644 --- a/config/initializers/new_framework_defaults_5_2.rb +++ b/config/initializers/new_framework_defaults_5_2.rb @@ -17,7 +17,7 @@ # It's best enabled when your entire app is migrated and stable on 5.2. # # Existing cookies will be converted on read then written with the new scheme. -# Rails.application.config.action_dispatch.use_authenticated_cookie_encryption = true +Rails.application.config.action_dispatch.use_authenticated_cookie_encryption = true # Use AES-256-GCM authenticated encryption as default cipher for encrypting messages # instead of AES-256-CBC, when use_authenticated_message_encryption is set to true.