Ruby-on-rails 没有为 Rack::Session::Cookie 警告提供秘密选项？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/10374871/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
No secret option provided to Rack::Session::Cookie warning?
提问by bigdaveyl
I am running Rails 3.2.3, Ruby 1.9 under Fedora 17. I get this warning, when I run rails s, and how do I fix?
我在 Fedora 17 下运行 Rails 3.2.3、Ruby 1.9。我在运行时收到此警告，我rails s该如何解决？
SECURITY WARNING: No secret option provided to Rack::Session::Cookie. This poses a security threat. It is strongly recommended that you provide a secret to prevent exploits that may be possible from crafted cookies. This will not be supported in future versions of Rack, and future versions will even invalidate your existing user cookies.
安全警告：没有提供给 Rack::Session::Cookie 的秘密选项。这构成了安全威胁。强烈建议您提供一个秘密，以防止可能通过精心制作的 cookie 进行攻击。这在 Rack 的未来版本中将不支持，未来版本甚至会使您现有的用户 cookie 失效。
采纳答案by Austin Lin
This is a Rails bug, as the subclass is violating the superclass API contract.
The warning can be safely ignored by Rails users.
这是一个 Rails 错误，因为子类违反了超类 API 契约。
Rails 用户可以安全地忽略该警告。
(https://github.com/rack/rack/issues/485#issuecomment-11956708, emphasis added)
（https://github.com/rack/rack/issues/485#issuecomment-11956708，重点补充）
Confirmation on the rails bug discussion: https://github.com/rails/rails/issues/7372#issuecomment-11981397
关于 rails bug 讨论的确认：https: //github.com/rails/rails/issues/7372#issuecomment-11981397
回答by iltempo
Reading the discussion based on tehgeekmeisters answer, this warning is popping up as Rails is using Rack cookies in a different way than intended. It should be ok to just ignore this warning for now until there is a final agreement on how to handle this issue and a fix in place.
阅读基于 tehgeekmeisters 回答的讨论，当 Rails 以与预期不同的方式使用 Rack cookie 时，会弹出此警告。在就如何处理此问题并就位修复达成最终协议之前，暂时忽略此警告应该是可以的。
回答by Henrik N
This issue has been worked around in the just released Rails 3.2.11.
这个问题已经在刚刚发布的 Rails 3.2.11 中解决了。
Log: https://github.com/rails/rails/commits/v3.2.11
日志：https: //github.com/rails/rails/commits/v3.2.11
Commit: https://github.com/rails/rails/commit/95fe9ef945a35f56fa1c3ef356aec4a3b868937c
提交：https: //github.com/rails/rails/commit/95fe9ef945a35f56fa1c3ef356aec4a3b868937c
回答by nbit001
rails 3.2.9 - ruby 1.9.3p125 (2012-02-16 revision 34643) [i686-linux]
rails 3.2.9 - ruby 1.9.3p125（2012-02-16 修订版 34643）[i686-linux]
Hello everyone, the following has worked for me, it may work for you.
大家好，以下对我有用，它可能对你有用。
/usr/local/lib/ruby/gems/1.9.1/gems/actionpack-3.2.9/lib/action_dispatch/middleware/session/abstract_store.rb
module Compatibility
def initialize(app, options = {})
options[:key] ||= '_session_id'
#fixed warning - SECURITY WARNING: No secret option provided to Rack::Session::Cookie.
options[:secret] ||= Rails.application.config.secret_token
super
end
end
回答by heartpunk
Downgrading to rack 1.4.1 should be sufficient to solve this for now. There's an issue openfor this and I just submitted a pull requestthat seems to fix it for me. In any case, watch the issue, and you should be able to upgrade to rack 1.4.2 after this is fixed.
现在降级到机架 1.4.1 应该足以解决这个问题。 有一个问题未解决，我刚刚提交了一个似乎为我修复它的拉取请求。无论如何，请注意问题，在修复此问题后您应该可以升级到机架 1.4.2。
Apparently, there's ongoing discussion about how to fix this on another issue. You'll have to either downgrade to 1.4.1, ignore it, or figure out your own fix until this is dealt with (and backported, if that even happens).
显然，正在讨论如何在另一个问题上解决这个问题。您必须降级到 1.4.1，忽略它，或者在解决此问题之前找出自己的修复程序（并且向后移植，如果发生这种情况）。
回答by Abhra Basak
An issue has been opened in Github https://github.com/rails/rails/issues/8789. It appears that a bug involving Rails 3.2.10 with Rack 1.4.2 is causing this. IMO, it can be safely ignored till the issue is resolved.
在 Github https://github.com/rails/rails/issues/8789 中打开了一个问题。似乎是一个涉及 Rails 3.2.10 和 Rack 1.4.2 的错误导致了这种情况。IMO，在问题解决之前可以安全地忽略它。
EDIT: This issue has been resolved in Rails 3.2.11.
编辑：此问题已在 Rails 3.2.11 中解决。
回答by leonyuan
rails update to 3.2.13 ,can solve this question.
rails 更新到 3.2.13，可以解决这个问题。
