CODEWITHSUNDEEP
ruby-on-railsruby-on-rails-3.2releaseproduction-environmentactivesupport
awendt
awendt

Reputation: 13723

Is ActiveSupport::MessageVerifier from Rails 3.2 production-ready?

Part of our team is working to upgrade our large codebase from Rails 3.2 to 4.2.

Before that is finished, I'd already like to use ActiveSupport::MessageVerifier for a new feature. The release notes for 4.1 included them so I naturally assumed they were introduced in 4.1.

I was trying to estimate the effort of backporting ActiveSupport::MessageVerifier to Rails 3. Going through its history, I discovered that the original commit has been included in Rails core since 2.3.0.

Now I wonder:

Is it safe to use the message verifier shipped in 3.2 in production?

Upvotes: 0

Views: 85

Answers (1)

Frederick Cheung
Frederick Cheung

Reputation: 84172

What's new in 4.1 is easy access to named verifiers that use secret_key_base. ActiveSupport::MessageVerifier has been used for signed cookies since 2.3.6 (here's the commit that added it) so I would definitely consider it production ready.

Upvotes: 3

Related Questions