Releases: redis-store/redis-rack
Update to Rack 2.0.8
This release adds support for Rack v2.0.8+, which was released a few weeks ago to address a session hijack vulnerability caused by a timing attack on the session store. Major shoutouts to @le0pard for implementing it and all of the reviewers who contributed suggestions and comments. If you use Redis to store your Rack session, you'll want to update redis-rack
and possibly redis-actionpack
if you're using Rails as well.
Support New Rack APIs
This changes the underlying API from using the legacy Rack::Session::Abstract::ID
to Rack::Session::Abstract::Persisted
, in order to bring it in line with the abstract cache stores provided by Rails that make use of this gem as a backend. As a consequence, this also drops support for Rack 2, so this prerelease is designed to give it a shot in the wild without affecting too many machines, we'll release a full v2.1.0 update in the coming weeks.
Fix nil options in connection pool
A quick bugfix to address #44
Blank Sessions Bugfix
Prevents Redis::Rack from storing blank session data.
redis-actionpack dependency hell
Due to the 2.x release's dependency on Rack 2.0, we need to release this new minor version to keep redis-store up to date without losing the connection to rails 5.