Is the Rails 2 ActionController::Base.session[:secret] redundant with Rails 3 Main::Application.config.secret_token?

Is the Rails 2 ActionController::Base.session开发者_JAVA技巧[:secret] redundant with Rails 3 Main::Application.config.secret_token?

I'm using activerecord sessions -- I still need the secret for my session cookie, right?

Is the same secret used for form submission validations?

---

You should not set the secret directly on ActionController::Base.session anymore. Use ApplicationName.config.secret_token.

If you intend to use Rails' unobtrusive Javascript functionality, read up on the new csrf_meta_tag view helper: http://apidock.com/rails/ActionView/Helpers/CsrfHelper/csrf_meta_tag