rack-session
rack-session copied to clipboard
Allow the v2 encryptor to serialize messages with `Marshal`
This is a follow-up on #39 that must be merged first.
I deliberately avoided allowing Marshal
serialization in the v2 encryptor because 1) Marshal
has been a source of RCE vulnerabilities and 2) serializing messages as JSON allows for better interoperability, making it trivial to access sessions created with rack-session in other languages.
However, it's impossible to swap Marhal
with JSON
without breaking users' code that relies on Marhal
behavior that JSON
doesn't mimic (e.g., preserving ruby symbols).
So... I see 3 ways forward:
- We close this PR and release yet another major
- We close this PR and make v2 opt-in instead of the default
- We merge this PR
Happy to hear some feedback.