我正在使用Ruby和Sinatra开发一个应用程序
我使用
enable :sessions
以便使用rack提供的会话变量。如何使所有会话cookie仅为HTTPOnly?默认情况下是这样的吗?我找不到任何有关这方面的文件。
代替enable :sessions
:
use Rack::Session::Cookie, {:httponly => true }
我建议使用encrypted_kokie gem,它要安全得多。举个例子,以下是我可能为一个项目准备的内容:
# app/main.rb
module Example
class App < Sinatra::Base # this class in its own file
# stuff here
end
end
# app/config.rb
require "main"
module Example
def self.app #
Rack::Builder.app do
cookie_settings = {
:key => 'usr',
:path => "/",
:expire_after => 86400, # In seconds, 1 day.
:secret => ENV["COOKIE_KEY"], # load this into the environment of the server
:httponly => true
}
cookie_settings.merge!( :secure => true ) if ENV["RACK_ENV"] == "production"
# AES encryption of cookies
use Rack::Session::EncryptedCookie, cookie_settings
# other stuff here
run App
end
end
end
# config.ru
require "app/config"
run Example.app # this in the rackup file
(为了澄清我为什么这样布局-这种结构允许我拆分应用程序,并通过只需要app/config.rb.YMMV在测试中更容易地使用它)