Skip to content

Commit

Permalink
documentation tweaks
Browse files Browse the repository at this point in the history
  • Loading branch information
kraih committed Dec 19, 2013
1 parent 5c8b8d5 commit 501a3aa
Show file tree
Hide file tree
Showing 3 changed files with 7 additions and 5 deletions.
2 changes: 2 additions & 0 deletions Changes
@@ -1,4 +1,6 @@

4.64 2013-12-20

4.63 2013-12-19
- Deprecated Mojolicious::secret in favor of Mojolicious::secrets.
- Added support for rotating secrets.
Expand Down
6 changes: 3 additions & 3 deletions lib/Mojolicious.pm
Expand Up @@ -43,7 +43,7 @@ has types => sub { Mojolicious::Types->new };
has validator => sub { Mojolicious::Validator->new };

our $CODENAME = 'Top Hat';
our $VERSION = '4.63';
our $VERSION = '4.64';

sub AUTOLOAD {
my $self = shift;
Expand Down Expand Up @@ -459,8 +459,8 @@ change it!!! As long as you are using the insecure default there will be debug
messages in the log file reminding you to change your passphrase. Only the
first passphrase is used to create new signatures, but all of them for
verification. So you can increase security without invalidating all your
signed cookies by rotating passphrases, just add new ones to the front and
remove old ones from the back.
existing signed cookies by rotating passphrases, just add new ones to the
front and remove old ones from the back.
# Rotate passphrases
$app->secrets(['new_passw0rd', 'old_passw0rd', 'very_old_passw0rd']);
Expand Down
4 changes: 2 additions & 2 deletions lib/Mojolicious/Guides/FAQ.pod
Expand Up @@ -106,8 +106,8 @@ to use the MOJO_REACTOR environment variable to enforce a more portable one.
=head2 What does "Your secret passphrase needs to be changed" mean?

L<Mojolicious> uses secret passphrases for security features such as signed
cookies. It defaults to the moniker of your application, which is not very
secure, so we added this log message as a reminder. You can change the
cookies. It defaults to using the moniker of your application, which is not
very secure, so we added this log message as a reminder. You can change the
passphrase with the attribute L<Mojolicious/"secrets">.

app->secrets(['My very secret passphrase.']);
Expand Down

0 comments on commit 501a3aa

Please sign in to comment.