While we're on the subject of Rails security, should this be of concern?
1–10 of 13 posts
Re: While we're on the subject of Rails security, should this be of concern?
#2I presume this is not strictly a Rails problem.
You can check in things that shouldn't be checked in with any language/framework.
If you have done this, here's how to fix it: http://help.github.com/remove-sensitive-data/
Re: While we're on the subject of Rails security, should this be of concern?
#3Not just rails, same for django (https://github.com/search?q=SECRET_KEY&repo=&langOve...) and I imagine any framework with this sort of thing in their default project skeleton
Re: While we're on the subject of Rails security, should this be of concern?
#4The solution is simple. Don't use a secret token :)
Re: While we're on the subject of Rails security, should this be of concern?
#5Not really. At least not in the way you are insinuating.
Re: While we're on the subject of Rails security, should this be of concern?
#6Soon, there will be articles on how insecure Git is because, well, it allows people to check-in sensitive stuff.
Re: While we're on the subject of Rails security, should this be of concern?
#7Facebook as well...
https://github.com/search?q=FB_SECRET&repo=&langOver...
Not really a "vulnerability" because you can't keep stupid people from giving out their secret key.
Re: While we're on the subject of Rails security, should this be of concern?
#8I presume this is not strictly a Rails problem. You can check in things that shouldn't be checked in with any language/framework. If you have done this, here's how to fix it: http://help.github.com/remove-sensitive-data/
Better is to change your security token and expire all sessions. Removing sensitive data should be seen as just a suggestion. Google never forgets.
Re: While we're on the subject of Rails security, should this be of concern?
#9This is not a language/framework based issue. This is an issue with careless and/or uneducated developers.
This is like people storing plain text passwords in publicly readable txt files on a server. It's not a problem with FTP, HTML, Apache (pick anything you'd like) it's a problem with people making poor decisions.
Re: While we're on the subject of Rails security, should this be of concern?
#10Could this help? https://github.com/rails/rails/pull/5286