May 0.35.3
A single fix, following on from 0.35.2.
Fixed
- An empty
.secret_keyfile in May's data folder no longer leaves every worker process signing sessions with a key of its own. The symptom was forms — creating a user, say — being refused with "The CSRF session token is missing", or simply doing nothing. May now fills in a key file that exists but holds nothing, rather than leaving it as it found it. A key file it cannot read at all is still left alone, since it may hold the key the other workers are using. (#315)
Notes
This is worth taking if you are on 0.35.2. That release started saving a generated key to data/.secret_key; if the very first write was interrupted, the empty file it left behind put May into exactly the state above, and nothing repaired it. Setting SECRET_KEY yourself avoids the whole business, and users of the supplied docker-compose.yml are unaffected — it passes a placeholder key of its own.
Thanks to the reporter of #315 for the clear account of what failed.