Skip to content

Commit 0952b2a

Browse files
Fix authentication generator double signature (rails#52786)
Before this commit, the session id stored in the cookies was signed twice: - Once with `cookies.signed` - Once with `session.signed_id` ```rb def set_current_session(session) # ... cookies.signed.permanent[:session_token] = { value: session.signed_id, httponly: true, same_site: :lax } end ``` This commit removes the double signature.
1 parent 28780de commit 0952b2a

File tree

1 file changed

+3
-5
lines changed
  • railties/lib/rails/generators/rails/authentication/templates/controllers/concerns

1 file changed

+3
-5
lines changed

railties/lib/rails/generators/rails/authentication/templates/controllers/concerns/authentication.rb

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -29,9 +29,7 @@ def resume_session
2929
end
3030

3131
def find_session_by_cookie
32-
if token = cookies.signed[:session_token]
33-
Session.find_signed(token)
34-
end
32+
Session.find_by(id: cookies.signed[:session_id])
3533
end
3634

3735

@@ -53,11 +51,11 @@ def start_new_session_for(user)
5351

5452
def set_current_session(session)
5553
Current.session = session
56-
cookies.signed.permanent[:session_token] = { value: session.signed_id, httponly: true, same_site: :lax }
54+
cookies.signed.permanent[:session_id] = { value: session.id, httponly: true, same_site: :lax }
5755
end
5856

5957
def terminate_session
6058
Current.session.destroy
61-
cookies.delete(:session_token)
59+
cookies.delete(:session_id)
6260
end
6361
end

0 commit comments

Comments
 (0)