Switch back to Rack::Session::Cookie, but generate a secret.

CHANGES

@@ -1,9 +1,7 @@
 = 1.2.1 / Not Yet Release
 
- * Switched default session middleware from `Rack::Session::Cookies` to
-   `Rack::Session::Pool`, to improve security. Using `Rack::Session::Cookies`
-   without a secret allows injecting arbitrary objects into sessions an, in a
-   worst case scenario, might lead to code injection. (Konstantin Haase)
+ * Use a generated session secret when using `enable :sessions`. (Konstantin
+   Haase)
 
 = 1.2.0 / 2011-03-03
 

lib/sinatra/base.rb

@@ -1232,10 +1232,9 @@ module Sinatra
       # an instance of this class as end point.
       def build(*args, &bk)
         builder = Rack::Builder.new
-        builder.use Rack::Session::Pool  if sessions?
-        builder.use Rack::CommonLogger   if logging?
-        builder.use Rack::MethodOverride if method_override?
-        builder.use ShowExceptions       if show_exceptions?
+        builder.use Rack::CommonLogger    if logging?
+        builder.use Rack::MethodOverride  if method_override?
+        builder.use ShowExceptions        if show_exceptions?
         middleware.each { |c,a,b| builder.use(c, *a, &b) }
         builder.run new!(*args, &bk)
         builder
@@ -1246,6 +1245,11 @@ module Sinatra
       end
 
     private
+      def setup_sessions(builder)
+        return unless sessions?
+        builder.use Rack::Session::Cookie, :secret => session_secret
+      end
+
       def detect_rack_handler
         servers = Array(server)
         servers.each do |server_name|
@@ -1342,6 +1346,9 @@ module Sinatra
     set :default_encoding, "utf-8"
     set :add_charset, [/^text\//, 'application/javascript', 'application/xml', 'application/xhtml+xml']
 
+    # explicitly generating this eagerly to play nice with preforking
+    set :session_secret, '%x' % rand(2**255)
+
     class << self
       alias_method :methodoverride?, :method_override?
       alias_method :methodoverride=, :method_override=