[wyldfire]

> Private Cookies #

> To encrypt private cookies, Rocket uses the 256-bit key specified in the secret_key configuration parameter. If one is not specified, Rocket automatically generates a fresh key at launch.

Seems like a pretty clever idea. Do other servers/middlewares offer a similar feature? Seems like it would complicate deployment/scaling a bit if the secret has to be sent to all the nodes. Especially if they could silently ignore it if you accidentally don't configure the key for some nodes.

[coolsunglasses]

Yesod does this too and it sometimes causes problems you first deploy an app to production.

[zimbatm]

Rails had encrypted cookies for ages

[wtetzner]

I think wyldfire was referring to the part about generating a new key on launch. Of course, Rails might do that too, for all I know.

[floatboth]

uhh generating a new key on launch means every time you restart the app, everyone's cookies must be reset because the old ones can't be decrypted anymore.

It's just a convenience feature for development.