Merge rust-lang#909

909: Update to latest conduit-cookie r=carols10cents

Will invalidate everyone's cookies, but we're only setting session
cookies right now anyway

Want to get this change:
conduit-rust/conduit-cookie#4

Author: bors-voyager[bot]

Cargo.lock

@@ -53,6 +53,7 @@ chrono = "0.4.0"
 conduit = "0.8"
 conduit-conditional-get = "0.8"
 conduit-cookie = "0.8"
+cookie = "0.9"
 conduit-json-parser = "0.8"
 conduit-log-requests = "0.8"
 conduit-middleware = "0.8"

Cargo.toml

@@ -43,6 +43,7 @@ extern crate url;
 extern crate conduit;
 extern crate conduit_conditional_get;
 extern crate conduit_cookie;
+extern crate cookie;
 extern crate conduit_git_http_backend;
 extern crate conduit_json_parser;
 extern crate conduit_log_requests;
@@ -219,9 +220,10 @@ pub fn middleware(app: Arc<App>) -> MiddlewareBuilder {
 
     m.around(util::Head::default());
     m.add(conduit_conditional_get::ConditionalGet);
-    m.add(conduit_cookie::Middleware::new(app.session_key.as_bytes()));
+    m.add(conduit_cookie::Middleware::new());
     m.add(conduit_cookie::SessionMiddleware::new(
         "cargo_session",
+        cookie::Key::from_master(app.session_key.as_bytes()),
         env == Env::Production,
     ));
     m.add(app::AppMiddleware::new(app));

src/lib.rs

@@ -121,7 +121,7 @@ fn app() -> (record::Bomb, Arc<App>, conduit_middleware::MiddlewareBuilder) {
 
     let config = cargo_registry::Config {
         uploader: uploader,
-        session_key: "test".to_string(),
+        session_key: "test this has to be over 32 bytes long".to_string(),
         git_repo_checkout: git::checkout(),
         gh_client_id: env::var("GH_CLIENT_ID").unwrap_or(String::new()),
         gh_client_secret: env::var("GH_CLIENT_SECRET").unwrap_or(String::new()),