Repository navigation
Read the session key from the SESSION_KEY environment variable - #480
Merged
Merged
Conversation
The Fernet key that encrypts the session cookie was generated fresh on every start, so each deploy or restart signed everyone out. The key now comes from SESSION_KEY, set in the cabotage UI like the other secrets. When it is missing, the app still generates a random key, which keeps local development working, and logs a warning.
A malformed value used to fail inside EncryptedCookieStorage with a message that did not say which variable was wrong. Also tightens the readme wording and drops an import the tests no longer need.
The generate command now lives in its own readme section under Deploy. The startup error and the missing-key warning just say what is wrong and refer to that section.
Without this the tests stayed green when the pointer was removed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Fernet key that encrypts the session cookie was generated fresh on every start, so each deploy or restart signed everyone out. On Heroku with rare deploys that was tolerable; on cabotage, where deploys are more frequent, it is not.
The key now comes from the
SESSION_KEYenvironment variable, set in the cabotage UI alongside the other secrets. When it is missing, the app still generates a random key so local development keeps working with no setup, and it logs a warning.EncryptedCookieStorageaccepts the key as a str and passes it straight toFernet, so the base64 round-trip in the old startup block is gone. The loading logic lives inget_session_key()so it can be tested; the two new tests cover both branches, including that the random fallback is a valid Fernet key.Also documents
SESSION_KEYin the readme, with the one-liner that generates it.The production
SESSION_KEYis already set on cabotage, so the first deploy after this merges signs everyone out one last time and every deploy after that keeps sessions.