4 ms·

354 matches. https://github.com/search?utf8=%E2%9C%93&q=secret_token.rb&ref=searchcontext https://github.com/search?utf8=%E2%9C%93&q=secret_token....

• SoftwareMaven 14y ago
  That's an interesting issue (Django has the same issue with its SECRET_KEY). If you have an open-source project that utilizes these kinds of technologies, you need to keep your secret key secret. As it says in the Django settings: "Make this unique, and don't share it with anybody." Your web application's security depends on it!
  • graue 14y ago
    Incidentally, this is one reason why the 12-factor app methodology stores configuration in environment variables, not source files. http://www.12factor.net/config http://www.12factor.net/config
• mikeryan 14y ago
  did you even look at what was matched? Change the cookie secret token at config/initializers/secret_token.rb Create a config/initializers/secret_token.rb file: That will rename your app in the following files: ... config/initializers/secret_token.rb Change your Application’s Secret Token ... Change the secret token at /config/initializers/secret_token.rb Those are the first six items in order and the trend continues at least through the first page of results.
  • paulgb 14y ago
    Good catch, I'm glad that it's a best practice. I wasn't trying to shame those projects, I'm not a rubiest so I was just trying to figure out how someone might gain access to a secret token.
• deleted 14y ago
  [deleted]