Ruby-on-rails 错误“安全警告：没有提供给 Rack::Session::Cookie 的秘密选项”
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/14191053/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Error 'SECURITY WARNING: No secret option provided to Rack::Session::Cookie'
提问by iCyborg
Possible Duplicate:
No secret option provided to Rack::Session::Cookie warning?
While creating scaffolding, I got this error today:
在创建脚手架时，我今天遇到了这个错误：
SECURITY WARNING: No secret option provided to Rack::Session::Cookie. This poses a security threat. It is strongly recommended that you provide a secret to prevent exploits that may be possible from crafted cookies. This will not be supported in future versions of Rack, and future versions will even invalidate your existing user cookies.
安全警告：没有提供给 Rack::Session::Cookie 的秘密选项。这构成了安全威胁。强烈建议您提供一个秘密，以防止可能通过精心制作的 cookie 进行攻击。这在 Rack 的未来版本中将不支持，未来版本甚至会使您现有的用户 cookie 失效。
But the key is set in config/initializers/secret_token.rb.
但是密钥设置在config/initializers/secret_token.rb.
Am I supposed to do anything or is this just a standard warning which I can safely ignore since I already have the key?
我应该做些什么还是这只是一个标准警告，我可以放心地忽略，因为我已经有了钥匙？
回答by Jonas Schubert Erlandsson
This is a known issueunder discussion. It is due to the upgrade to Rack 1.4.2 and your choices. Until Rails is updated with a solution, your should ignore the error or downgrade to Rack 1.4.1, according to the people that know ;)
这是一个正在讨论的已知问题。这是由于升级到 Rack 1.4.2 和您的选择。根据知情人士的说法，在 Rails 更新解决方案之前，您应该忽略错误或降级到 Rack 1.4.1 ;)
回答by Sri
According to the discussion in some other sites, this warning is popping up as Rails is using Rack cookies in a different way than intended. It should be ok to just ignore this warning for now until there is a final agreement on how to handle this issue and a fix in place.
根据其他一些站点的讨论，当 Rails 以与预期不同的方式使用 Rack cookie 时，会弹出此警告。在就如何处理此问题并就位修复达成最终协议之前，暂时忽略此警告应该是可以的。
