[ci skip] Prefer cookies.encrypted over signed (rails#30129)

claudiob · David Heinemeier Hansson · commit af954ddd54e2 · 2017-08-07T22:32:03.000-05:00
In some examples and guides we are recommending to use code like:

```ruby
verified_user = User.find_by(id: cookies.signed[:user_id])
```

My suggestion is to use instead:

```ruby
verified_user = User.find_by(id: cookies.encrypted[:user_id])
```

which invites users to prefer the "newer" encrypted cookies over the
"legacy" signed cookies.
diff --git a/actioncable/README.md b/actioncable/README.md
@@ -53,7 +53,7 @@ module ApplicationCable
 
     private
       def find_verified_user
-        if verified_user = User.find_by(id: cookies.signed[:user_id])
+        if verified_user = User.find_by(id: cookies.encrypted[:user_id])
           verified_user
         else
           reject_unauthorized_connection
diff --git a/actioncable/lib/action_cable/connection/base.rb b/actioncable/lib/action_cable/connection/base.rb
@@ -26,7 +26,7 @@ module Connection
     #
     #       private
     #         def find_verified_user
-    #           User.find_by_identity(cookies.signed[:identity_id]) ||
+    #           User.find_by_identity(cookies.encrypted[:identity_id]) ||
     #             reject_unauthorized_connection
     #         end
     #     end
diff --git a/activesupport/lib/active_support/current_attributes.rb b/activesupport/lib/active_support/current_attributes.rb
@@ -33,7 +33,7 @@ module ActiveSupport
   #
   #     private
   #       def authenticate
-  #         if authenticated_user = User.find_by(id: cookies.signed[:user_id])
+  #         if authenticated_user = User.find_by(id: cookies.encrypted[:user_id])
   #           Current.user = authenticated_user
   #         else
   #           redirect_to new_session_url
diff --git a/guides/source/action_cable_overview.md b/guides/source/action_cable_overview.md
@@ -64,7 +64,7 @@ module ApplicationCable
 
     private
       def find_verified_user
-        if verified_user = User.find_by(id: cookies.signed[:user_id])
+        if verified_user = User.find_by(id: cookies.encrypted[:user_id])
           verified_user
         else
           reject_unauthorized_connection

Original file line number	Diff line number	Diff line change
`@@ -26,7 +26,7 @@ module Connection`
`26`	`26`	`#`
`27`	`27`	`# private`
`28`	`28`	`# def find_verified_user`
`29`		`- # User.find_by_identity(cookies.signed[:identity_id]) \|\|`
	`29`	`+ # User.find_by_identity(cookies.encrypted[:identity_id]) \|\|`
`30`	`30`	`# reject_unauthorized_connection`
`31`	`31`	`# end`
`32`	`32`	`# end`
Original file line number	Diff line number	Diff line change
`@@ -33,7 +33,7 @@ module ActiveSupport`
`33`	`33`	`#`
`34`	`34`	`# private`
`35`	`35`	`# def authenticate`
`36`		`- # if authenticated_user = User.find_by(id: cookies.signed[:user_id])`
	`36`	`+ # if authenticated_user = User.find_by(id: cookies.encrypted[:user_id])`
`37`	`37`	`# Current.user = authenticated_user`
`38`	`38`	`# else`
`39`	`39`	`# redirect_to new_session_url`