[PATCH] Rails generates insecure secret keys for CookieStore

I think rails should include securerandom.rb from ruby 1.9 and have the code for windows in rescue section so that it's compatible with future versions of ruby.

The individual generate_* methods are pretty good, but I think the dispatching done in generate is a bit convoluted. Perhaps something like this might work better:

GENERATORS = [ :secure_random, :win32_api, :urandom, :openssl, :prng ].freeze

def included(base)
  generator = GENERATORS.find { |g| send("supports_#{g}?") }
  base.alias_method_chain :generate_secret, generator
end

# ...

private
  def supports_secure_random?
    begin
      require 'securerandom'
      true
    rescue LoadError
      false
    end
  end

  def supports_win32_api?
    return false unless RUBY_PLATFORM =~ /(:?mswin|mingw)/
    begin
      require 'Win32API'
      true
    rescue LoadError
      false
    end
  end

  def supports_urandom?
    File.exists?('/dev/urandom')
  end

  def supports_openssl?
    begin
      require 'openssl'
      true
    rescue LoadError
      false
    end
  end

  def supports_prng?
    true
  end

This way the decision on which generator to load is made when the module is included and not at runtime. Plus its easier to add/subtract generators over time. You can even remove the supports_* methods from your tests and just reference the ones in module.

Here is a new patch which includes the suggestions by dkubb.

(In [8229]) Introduce SecretKeyGenerator for more secure session secrets than CGI::Session's pseudo-random id generator. Consider extracting to Active Support later. Closes #10286.