Kemal::Session::Config
Inherits Reference < Object
Configuration singleton. Mirrors the kemal-session config surface where
it makes sense for a client-side (cookie) store, plus a few Rails-specific
knobs (salt, iterations). engine / gc_interval from kemal-session
have no analogue here: the cookie is the storage.
Constants
Instance methods
Cookie name. Also determines the message purpose cookie.<cookie_name>.
Rails' default session key is _session_id.
Cookie name. Also determines the message purpose cookie.<cookie_name>.
Rails' default session key is _session_id.
CSRF: base URL the Origin header is compared against, e.g.
"https://app.example.com". Derived from X-Forwarded-Proto/Host when
nil; set it explicitly when running behind a proxy that doesn't forward
the original scheme.
CSRF: base URL the Origin header is compared against, e.g.
"https://app.example.com". Derived from X-Forwarded-Proto/Host when
nil; set it explicitly when running behind a proxy that doesn't forward
the original scheme.
CSRF: whether the Origin header is checked against the request's base URL
(Rails' config.action_controller.forgery_protection_origin_check).
CSRF: whether the Origin header is checked against the request's base URL
(Rails' config.action_controller.forgery_protection_origin_check).
CSRF: the request parameter carrying the token (Rails'
config.action_controller.request_forgery_protection_token).
CSRF: the request parameter carrying the token (Rails'
config.action_controller.request_forgery_protection_token).
CSRF: whether per-form tokens are issued and accepted. Must match the Rails
app's config.action_controller.per_form_csrf_tokens, which is true under
load_defaults 5.2 or later.
CSRF: whether per-form tokens are issued and accepted. Must match the Rails
app's config.action_controller.per_form_csrf_tokens, which is true under
load_defaults 5.2 or later.
CSRF: whether X-Forwarded-Proto / X-Forwarded-Host are believed when
deriving the base URL the Origin header is compared against. true
matches Rails' request.base_url, and is safe behind a proxy that
overwrites those headers; set it to false when anything can reach the
app directly, so a spoofed forwarded host can't satisfy the check.
Ignored when csrf_base_url is set.
CSRF: whether X-Forwarded-Proto / X-Forwarded-Host are believed when
deriving the base URL the Origin header is compared against. true
matches Rails' request.base_url, and is safe behind a proxy that
overwrites those headers; set it to false when anything can reach the
app directly, so a spoofed forwarded host can't satisfy the check.
Ignored when csrf_base_url is set.
PBKDF2 iteration count. Rails uses 1000 for its application key generator.
Key-derivation salt. Defaults to Rails' authenticated-encrypted-cookie salt.
The Rails secret_key_base. Required; cryptographic operations raise
SecretRequiredException while this is empty.
The Rails secret_key_base. Required; cryptographic operations raise
SecretRequiredException while this is empty.
false is Rails' default too (it leans on force_ssl). Set it to true
for any app served over HTTPS, or the cookie also travels over plain HTTP.
false is Rails' default too (it leans on force_ssl). Set it to true
for any app served over HTTPS, or the cookie also travels over plain HTTP.
Optional cookie lifetime. nil (default) emits a session cookie with a
null metadata expiry, matching a default Rails session. When set, the
cookie gets an Expires and the metadata envelope an exp.
Optional cookie lifetime. nil (default) emits a session cookie with a
null metadata expiry, matching a default Rails session. When set, the
cookie gets an Expires and the metadata envelope an exp.