A Better Way to Manage the Rails Secret Token
daniel.fone.net.nz
A Better Way to Manage the Rails Secret Token
1–10 of 60 posts
Re: A Better Way to Manage the Rails Secret Token
#2[deleted]
Re: A Better Way to Manage the Rails Secret Token
#3I wrote a gem called envious that could be used as an alternative to dotenv: https://github.com/RyanNielson/envious from what I can see it does a few things dotenv doesn't. Good guide though, I wrote Envious when I found out this problem existed.
Re: A Better Way to Manage the Rails Secret Token
#4I'm not sure I understand what dotenv does (or why you would need it to do it).
Re: A Better Way to Manage the Rails Secret Token
#5I wish Rails supported two secrets the way Rack::Cookie does by always signing with the first, but accepting either. That way you can rotate the secret without signing everyone out.
Re: A Better Way to Manage the Rails Secret Token
#6> if Rails.env.development? or Rails.env.test?
I hate code like this that is explicitly aware of the environment. The code says what it will do in an environment, rather than the environment saying what the code should do in it.
Re: A Better Way to Manage the Rails Secret Token
#7Eh... Keeping that in the system environment isn't really any better than hardcoded in a file. There's a long history of "do not trust the system environment" when it comes to security so I can't say I'd recommend this. Last I checked it was also fairly trivial to dump this data out of a running program...
Unless you're grabbing that key out of "secure memory", a HSM or a TPM then its not really particularly secure.
Re: A Better Way to Manage the Rails Secret Token
#8I'm not sure I understand what dotenv does (or why you would need it to do it).
It loads environment variables from a .env file when starting your app so that you don't have to do
$ SECRET_TOKEN=abcdef SOME_OTHER_VAR=hello rails s
or pollute your .profile with a bunch of app-specific variables.
You don't need it to do it; it just makes it easier.
Re: A Better Way to Manage the Rails Secret Token
#9> Knowing the secret token allows an attacker to trivially impersonate any user in the application.
Worse. Knowing the secret token allows an attacker to trivially execute code in your application.
Don't ever let your secret token become public knowledge, and if it does, you need to change it straight away.
Re: A Better Way to Manage the Rails Secret Token
#10LOL BROGRAMMERS