4 ms·
I consider this in the same realm as storing passwords to plain text. People do it out of ignorance until they're learn the hard way not to (or some kind soul
by iaw 14y ago
I consider this in the same realm as storing passwords to plain text. People do it out of ignorance until they're learn the hard way not to (or some kind soul saves them from that disaster).
- ajross 14y agoHow is this not considered a framework bug? "Secret tokens" are project-specific configuration more or less by definition. Putting them in something that lives in a source directory is simply asking for this kind of mistake. Rails deployments aren't leaking their ssh keys or database content because that is stored separately. To paraphrase the title: these things are stored separately for a reason. Get this thing out of the source, guys.
- kawsper 14y agodatabase.yml is also placed in config-directory. secret_token.rb is placed where it is, because it is a initializer. http://guides.rubyonrails.org/configuring.html#locations-for-initialization-code http://guides.rubyonrails.org/configuring.html#locations-for...
- ajross 14y agoHow is "because it is a initializer" a response to the point? The fact that it is implemented as Ruby code has nothing to do with whether or not it should be stored in a source code directory. Clearly it should not. Yet it is. That's a framework bug.