4 ms·
I write most of my web apps using Sinatra (as per the article example), but do it using the Padrino [1] framework. Padrino by default sets the Sinatra session
by cyberferret 10y ago
I write most of my web apps using Sinatra (as per the article example), but do it using the Padrino [1] framework. Padrino by default sets the Sinatra session secrets to a long hash, which negates the developer from having to remember to do all this housekeeping later to tighten security on the app.
[1] - https://www.padrinorb.com https://www.padrinorb.com
- arkadiyt 10y agoPadrino sets the session secret to a random value on startup if you don't set it yourself. This means that: 1) you can only run a single instance. Multiple instances will generate different secrets and not accept each others' cookies 2) restarting an instance (for instance doing a deploy) generates a new secret and invalidates all previous cookies Neither of these are desirable, and to avoid it the docs recommend [1] you set the session secret yourself via: set :session_secret, 'super secret' which gives you the exact problem the blog post is addressing, so it does not seem that Padrino does any better here. [1] - http://padrinorb.com/guides/controllers/sessions/ http://padrinorb.com/guides/controllers/sessions/