Rails session secret should not be in a public repository
You can move the rails session secret to an environment variable by modifying config/initializers/secret_token.rb like this:
MyApp::Application.config.secret_token = ENV['RAILS_SESSION_SECRET']Given that you have the pwgen utility installed you can start your rails server in your development environment this way:
% RAILS_SESSION_SECRET=`pwgen -cns 128` rails serverWritten by Jens Grassel
Related protips
Have a fresh tip? Share with Coderwall community!
Post
Post a tip
Best
#Rails
Authors
Did you know?
Most application security programs still stop at the repository. The page a visitor loads can run third-party scripts that read the DOM, change a checkout, or steal a session after the deploy already looks clean.
Security insights from Cside
Sponsored by #native_company# — Learn More
#native_title#
#native_desc#