5 ms·
> Private Cookies # > To encrypt private cookies, Rocket uses the 256-bit key specified in the secret_key configuration parameter. If one is not specified, Roc
by wyldfire 9y ago
> Private Cookies #
> To encrypt private cookies, Rocket uses the 256-bit key specified in the secret_key configuration parameter. If one is not specified, Rocket automatically generates a fresh key at launch.
Seems like a pretty clever idea. Do other servers/middlewares offer a similar feature? Seems like it would complicate deployment/scaling a bit if the secret has to be sent to all the nodes. Especially if they could silently ignore it if you accidentally don't configure the key for some nodes.
- zimbatm 9y agoRails had encrypted cookies for ages
- wtetzner 9y agoI think wyldfire was referring to the part about generating a new key on launch. Of course, Rails might do that too, for all I know.
- floatboth 9y agouhh generating a new key on launch means every time you restart the app, everyone's cookies must be reset because the old ones can't be decrypted anymore. It's just a convenience feature for development.
- coolsunglasses 9y agoYesod does this too and it sometimes causes problems you first deploy an app to production.