From 23dc19a665fda5a62cd35eaaf820070b93fa901c Mon Sep 17 00:00:00 2001
From: Karina Kwiatek <kjk@kjk.dog>
Date: Tue, 14 Feb 2023 12:47:09 +0100
Subject: [PATCH] Add cookie rotation for switching from SHA1 to SHA256

---
 config/initializers/cookie_rotator.rb | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
 create mode 100644 config/initializers/cookie_rotator.rb

diff --git a/config/initializers/cookie_rotator.rb b/config/initializers/cookie_rotator.rb
new file mode 100644
index 00000000..65a33147
--- /dev/null
+++ b/config/initializers/cookie_rotator.rb
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+Rails.application.config.after_initialize do
+  Rails.application.config.action_dispatch.cookies_rotations.tap do |cookies|
+    salt = Rails.application.config.action_dispatch.authenticated_encrypted_cookie_salt
+    secret_key_base = Rails.application.secret_key_base
+
+    key_generator = ActiveSupport::KeyGenerator.new(
+      secret_key_base, iterations: 1000, hash_digest_class: OpenSSL::Digest::SHA1
+    )
+    key_len = ActiveSupport::MessageEncryptor.key_len
+    secret = key_generator.generate_key(salt, key_len)
+
+    cookies.rotate :encrypted, secret
+  end
+end