Comment on Reminder: secret_token.rb is named so for a reasonComments−joevandyk13yWhy don't more people keep configuration / api keys / etc in the database?1. Your configuration is backed up along with your data.2. You can share configuration with multiple applications easily.3. Use postgresql's LISTEN/NOTIFY to tell your applications about new configuration changes in real-time.4. Your configuration is as secret as your data.−krapp13yIf you're vulnerable to a sql injection or something similar, though, then you've potentially made all of that data web accessible.−joevandyk13yIf you are vulnerable to sql injection, you are completely screwed anyways.−krapp13ythat's probably true.−dice13yWhere do you store the configuration for where and how to access the configuration database?−joevandyk13yThat's the only thing I keep as an env var (as DATABASE_URL: ie "postgres://monkey:pass@localhost/tanga_dev")
Comments
Why don't more people keep configuration / api keys / etc in the database?
1. Your configuration is backed up along with your data.
2. You can share configuration with multiple applications easily.
3. Use postgresql's LISTEN/NOTIFY to tell your applications about new configuration changes in real-time.
4. Your configuration is as secret as your data.
If you're vulnerable to a sql injection or something similar, though, then you've potentially made all of that data web accessible.
If you are vulnerable to sql injection, you are completely screwed anyways.
that's probably true.
Where do you store the configuration for where and how to access the configuration database?
That's the only thing I keep as an env var (as DATABASE_URL: ie "postgres://monkey:pass@localhost/tanga_dev")