Error 'SECURITY WARNING: No secret option provided to Rack::Session::Cookie'

Ruby on-Rails

Ruby on-Rails Problem Overview


> Possible Duplicate:
> No secret option provided to Rack::Session::Cookie warning?

While creating scaffolding, I got this error today:

> SECURITY WARNING: No secret option provided to Rack::Session::Cookie. This poses a security threat. It is strongly recommended that you provide a secret to prevent exploits that may be possible from crafted cookies. This will not be supported in future versions of Rack, and future versions will even invalidate your existing user cookies.

But the key is set in config/initializers/secret_token.rb.

Am I supposed to do anything or is this just a standard warning which I can safely ignore since I already have the key?

Ruby on-Rails Solutions


Solution 1 - Ruby on-Rails

This is a known [issue][1] under discussion. It is due to the upgrade to Rack 1.4.2 and your choices. Until Rails is updated with a solution, your should ignore the error or downgrade to Rack 1.4.1, according to the people that know ;)

[1]: https://github.com/rails/rails/issues/7372 "Github issue"

Solution 2 - Ruby on-Rails

According to the discussion in some other sites, this warning is popping up as Rails is using Rack cookies in a different way than intended. It should be ok to just ignore this warning for now until there is a final agreement on how to handle this issue and a fix in place.

Attributions

All content for this solution is sourced from the original question on Stackoverflow.

The content on this page is licensed under the Attribution-ShareAlike 4.0 International (CC BY-SA 4.0) license.

Content TypeOriginal AuthorOriginal Content on Stackoverflow
QuestioniCyborgView Question on Stackoverflow
Solution 1 - Ruby on-RailsJonas Schubert ErlandssonView Answer on Stackoverflow
Solution 2 - Ruby on-RailsSriView Answer on Stackoverflow