Comment on Securing the Rails session secretComments−MattRogish13yWe use Heroku and PaaS environment variables, with a default value if you're running in development/test mode, e.g.if Rails.env.production? && ENV['SECRET_TOKEN'].blank? raise 'SECRET_TOKEN environment variable must be set!' endsecret_token = ENV['SECRET_TOKEN'] || 'safdasfjlkj...'−tptacek13yMake sure your session secret is a long random string (it might be tempting, if you're passing it in through the environment, to make it shorter or readable). It's an HMAC key that anyone who can get a session from your application can dictionary.−MattRogish13yOh yes. It's probably ridiculously long (I think 256 chars, letters numbers special etc) :)
Comments
We use Heroku and PaaS environment variables, with a default value if you're running in development/test mode, e.g.
if Rails.env.production? && ENV['SECRET_TOKEN'].blank? raise 'SECRET_TOKEN environment variable must be set!' end
secret_token = ENV['SECRET_TOKEN'] || 'safdasfjlkj...'
Make sure your session secret is a long random string (it might be tempting, if you're passing it in through the environment, to make it shorter or readable). It's an HMAC key that anyone who can get a session from your application can dictionary.
Oh yes. It's probably ridiculously long (I think 256 chars, letters numbers special etc) :)