# HG changeset patch
# User Marcin Kuzminski <marcin@python-works.com>
# Date 2013-06-07 17:23:20
# Node ID c9ca7fa55b0de20373ae434a720d50f1ae51c1ce
# Parent  e1a0fdaecf63e6d3f8b6f663e284352955754ded

Fill session cookie secret with random generated app_uuid.
By default this setup is much more secure since it uses
SignedCookies instead of plain ones

diff --git a/development.ini b/development.ini
--- a/development.ini
+++ b/development.ini
@@ -293,9 +293,11 @@ beaker.cache.sql_cache_long.key_length =
 ## file based cookies (default) ##
 #beaker.session.type = file
 
+beaker.session.key = rhodecode
+beaker.session.secret = ${app_instance_uuid}
 
-beaker.session.key = rhodecode
-## secure cookie requires AES python libraries
+## Secure encrypted cookie. Requires AES and AES python libraries
+## you must disable beaker.session.secret to use this
 #beaker.session.encrypt_key = <key_for_encryption>
 #beaker.session.validate_key = <validation_key>
 
diff --git a/production.ini b/production.ini
--- a/production.ini
+++ b/production.ini
@@ -293,9 +293,11 @@ beaker.cache.sql_cache_long.key_length =
 ## file based cookies (default) ##
 #beaker.session.type = file
 
+beaker.session.key = rhodecode
+beaker.session.secret = ${app_instance_uuid}
 
-beaker.session.key = rhodecode
-## secure cookie requires AES python libraries
+## Secure encrypted cookie. Requires AES and AES python libraries
+## you must disable beaker.session.secret to use this
 #beaker.session.encrypt_key = <key_for_encryption>
 #beaker.session.validate_key = <validation_key>
 
diff --git a/rhodecode/config/deployment.ini_tmpl b/rhodecode/config/deployment.ini_tmpl
--- a/rhodecode/config/deployment.ini_tmpl
+++ b/rhodecode/config/deployment.ini_tmpl
@@ -293,9 +293,11 @@ beaker.cache.sql_cache_long.key_length =
 ## file based cookies (default) ##
 #beaker.session.type = file
 
+beaker.session.key = rhodecode
+beaker.session.secret = ${app_instance_uuid}
 
-beaker.session.key = rhodecode
-## secure cookie requires AES python libraries
+## Secure encrypted cookie. Requires AES and AES python libraries
+## you must disable beaker.session.secret to use this
 #beaker.session.encrypt_key = <key_for_encryption>
 #beaker.session.validate_key = <validation_key>