Commits on Oct 1, 2024

1. Generate and persist a 256 bit session secret by default …

   * Add `urandom_bytes` and `urandom_urlsafe` to `Mojo::Util` for
     generating secure random bits from either Crypt::Random or
     /dev/urandom
   
   * Don't use the hard coded moniker as the default secret
   
   * Generate and store a strong secret if not exists in
     `$ENV{MOJO_HOME}/mojo.secrets`, overridable with
     `$ENV{MOJO_SECRETS_FILE}` when app->secrets is called
   
   * Only load secrets from `mojo.secrets` that are over 22 chars
   
   * Use `urandom_urlsafe` when generating CSRF tokens
   
   * Use `urandom_urlsafe` when in `mojo generate app`
   
   * Add `mojo generate secret`
   
   * Tests:
   
     - Add misc tests for generating and loading mojo.secrets in
       `t/mojolicious/secret/` and for `mojo generate secret`.
   
     - Add a default secret in `t/mojolicious/mojo.secrets` so other
       session checks work
   
   * Install Crypt::URandom in GH Windows workflow so urandom_bytes works
     on that platform

   

   stigtsp committed Oct 1, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for fb4ae3f
   • Browse repository at this point

   Copy the full SHA

   fb4ae3f View commit details

   Browse the repository at this point in the history