From 6c26a8b40ea6f8995adb2c3d538c181ca9b62ca5 Mon Sep 17 00:00:00 2001 From: Michael Kohl Date: Tue, 11 Jan 2022 01:35:28 +0700 Subject: [PATCH] Update framework defaults (#15988) * Update framework defaults to 6.0 * Update application.rb --- config/application.rb | 47 ++++++++++++++----- .../new_framework_defaults_5_2.rb | 43 ----------------- .../new_framework_defaults_6_0.rb | 47 ------------------- 3 files changed, 34 insertions(+), 103 deletions(-) delete mode 100644 config/initializers/new_framework_defaults_5_2.rb delete mode 100644 config/initializers/new_framework_defaults_6_0.rb diff --git a/config/application.rb b/config/application.rb index 7c51034b7..2470621d1 100644 --- a/config/application.rb +++ b/config/application.rb @@ -23,10 +23,41 @@ Dotenv::Railtie.load if Rails.env.test? || Rails.env.development? module PracticalDeveloper class Application < Rails::Application - # Initialize configuration defaults for originally generated Rails version. - config.load_defaults 5.1 # NOTE: [Rails 6] we should at least work towards updating this to 5.2 + # Specify the default Rails settings version we're targetting + # See: https://guides.rubyonrails.org/configuring.html#results-of-config-load-defaults + config.load_defaults 6.0 - # [Rails 6] Zeitwerk is the new autoloader + ### FRAMEWORK DEFAULT OVERRIDES + # Override new framework defaults to keep existing behavior. + # + # NOTE: For booleans the new default is the opposite of what we're setting here. For other + # options, the new default is mentioned in a comment. Once we're ready to enable a new default + # setting we can remove the line here. + + ## Rails 5.0 + # There is no easy way to use per-form tokens and view caching at the same time. + # Therefore we disable "per_form_csrf_tokens" for the time being. + config.action_controller.per_form_csrf_tokens = false + + ## Rails 6.0 + # Determines whether forms are generated with a hidden tag that forces older versions of Internet + # Explorer to submit forms encoded in UTF-8 + config.action_view.default_enforce_utf8 = true + + # Enables the same cache key to be reused when the object being cached of type ActiveRecord::Relation + # changes by moving the volatile information (max updated at and count) of the relation's cache + # key into the cache version to support recycling cache key. + config.active_record.collection_cache_versioning = false + + # Enables writing cookies with the purpose metadata embedded. + config.action_dispatch.use_cookies_with_metadata = false + + ## Rails 6.1 + # This replaces the old config.active_support.use_sha1_digests from Rails 5.2 + config.active_support.hash_digest_class = ::Digest::MD5 # New default is ::Digest::SHA1 + ### END FRAMEWORK DEFAULT OVERIDES + + # Zeitwerk is the new autoloader in Rails 6+ # As we don't have `load_defaults 6.0` yet, it has to be enabled manually # See config.autoloader = :zeitwerk @@ -42,7 +73,6 @@ module PracticalDeveloper # Application configuration can go into files in config/initializers # -- all .rb files in that directory are automatically loaded after loading # the framework and any gems in your application. - config.autoload_paths += Dir["#{config.root}/lib"] config.eager_load_paths += Dir["#{config.root}/lib"] @@ -62,15 +92,6 @@ module PracticalDeveloper # Globally handle Pundit::NotAuthorizedError by serving 404 config.action_dispatch.rescue_responses["Pundit::NotAuthorizedError"] = :not_found - # Rails 5.1 introduced CSRF tokens that change per-form. - # Unfortunately there isn't an easy way to use them and use view caching at the same time. - # Therefore we disable "per_form_csrf_tokens" for the time being. - config.action_controller.per_form_csrf_tokens = false - - # NOTE: [Rails 6] - # To improve security, Rails embeds the purpose and expiry metadata inside encrypted or signed cookies value. - config.action_dispatch.use_cookies_with_metadata = false - # After-initialize checker to add routes to reserved words config.after_initialize do # Add routes to reserved words diff --git a/config/initializers/new_framework_defaults_5_2.rb b/config/initializers/new_framework_defaults_5_2.rb deleted file mode 100644 index 991545d1b..000000000 --- a/config/initializers/new_framework_defaults_5_2.rb +++ /dev/null @@ -1,43 +0,0 @@ -# Be sure to restart your server when you modify this file. -# -# This file contains migration options to ease your Rails 5.2 upgrade. -# -# Once upgraded flip defaults one by one to migrate to the new default. -# -# Read the Guide for Upgrading Ruby on Rails for more info on each option. - -# Make Active Record use stable #cache_key alongside new #cache_version method. -# This is needed for recyclable cache keys. -Rails.application.config.active_record.cache_versioning = true - -# Use AES-256-GCM authenticated encryption for encrypted cookies. -# Also, embed cookie expiry in signed or encrypted cookies for increased security. -# -# This option is not backwards compatible with earlier Rails versions. -# It's best enabled when your entire app is migrated and stable on 5.2. -# -# Existing cookies will be converted on read then written with the new scheme. -Rails.application.config.action_dispatch.use_authenticated_cookie_encryption = true - -# Use AES-256-GCM authenticated encryption as default cipher for encrypting messages -# instead of AES-256-CBC, when use_authenticated_message_encryption is set to true. -Rails.application.config.active_support.use_authenticated_message_encryption = true - -# Add default protection from forgery to ActionController::Base instead of in -# ApplicationController. -Rails.application.config.action_controller.default_protect_from_forgery = true - -# Store boolean values are in sqlite3 databases as 1 and 0 instead of 't' and -# 'f' after migrating old data. -# Rails.application.config.active_record.sqlite3.represent_boolean_as_integer = true - -# NOTE: we can't enable this just yet, because it changes how "ActiveSupport::Digest.hexdigest" -# generates digests, which in turn is used by "ActionView::Digestor", which in turn is used by the -# see and -# -# Use SHA-1 instead of MD5 to generate non-sensitive digests, such as the ETag header. -# NOTE: deprecated in Rails 6.1 in favor of config.active_support.hash_digest_class = ::Digest::SHA1 -# Rails.application.config.active_support.use_sha1_digests = true - -# Make `form_with` generate id attributes for any generated HTML tags. -Rails.application.config.action_view.form_with_generates_ids = true diff --git a/config/initializers/new_framework_defaults_6_0.rb b/config/initializers/new_framework_defaults_6_0.rb deleted file mode 100644 index 628f2b255..000000000 --- a/config/initializers/new_framework_defaults_6_0.rb +++ /dev/null @@ -1,47 +0,0 @@ -# Be sure to restart your server when you modify this file. -# -# This file contains migration options to ease your Rails 6.0 upgrade. -# -# Once upgraded flip defaults one by one to migrate to the new default. -# -# Read the Guide for Upgrading Ruby on Rails for more info on each option. - -# Don't force requests from old versions of IE to be UTF-8 encoded. -# Rails.application.config.action_view.default_enforce_utf8 = false - -# Embed purpose and expiry metadata inside signed and encrypted -# cookies for increased security. -# -# This option is not backwards compatible with earlier Rails versions. -# It's best enabled when your entire app is migrated and stable on 6.0. -# Rails.application.config.action_dispatch.use_cookies_with_metadata = true - -# NOTE: deprecated in Rails 6.1, see -# Change the return value of `ActionDispatch::Response#content_type` to Content-Type header without modification. -# Rails.application.config.action_dispatch.return_only_media_type_on_content_type = false - -# NOTE: deprecated in Rails 6.1, see -# Return false instead of self when enqueuing is aborted from a callback. -# Rails.application.config.active_job.return_false_on_aborted_enqueue = true - -# Send Active Storage analysis and purge jobs to dedicated queues. -# Rails.application.config.active_storage.queues.analysis = :active_storage_analysis -# Rails.application.config.active_storage.queues.purge = :active_storage_purge - -# When assigning to a collection of attachments declared via `has_many_attached`, replace existing -# attachments instead of appending. Use #attach to add new attachments without replacing existing ones. -# Rails.application.config.active_storage.replace_on_assign_to_many = true - -# Use ActionMailer::MailDeliveryJob for sending parameterized and normal mail. -# -# The default delivery jobs (ActionMailer::Parameterized::DeliveryJob, ActionMailer::DeliveryJob), -# will be removed in Rails 6.1. This setting is not backwards compatible with earlier Rails versions. -# If you send mail in the background, job workers need to have a copy of -# MailDeliveryJob to ensure all delivery jobs are processed properly. -# Make sure your entire app is migrated and stable on 6.0 before using this setting. -Rails.application.config.action_mailer.delivery_job = "ActionMailer::MailDeliveryJob" - -# Enable the same cache key to be reused when the object being cached of type -# `ActiveRecord::Relation` changes by moving the volatile information (max updated at and count) -# of the relation's cache key into the cache version to support recycling cache key. -# Rails.application.config.active_record.collection_cache_versioning = true