3 ms·
We use Heroku and PaaS environment variables, with a default value if you're running in development/test mode, e.g. if Rails.env.production? && ENV['SECRET_TOK
by MattRogish 14y ago
We use Heroku and PaaS environment variables, with a default value if you're running in development/test mode, e.g.
if Rails.env.production? && ENV['SECRET_TOKEN'].blank?
raise 'SECRET_TOKEN environment variable must be set!'
end
secret_token = ENV['SECRET_TOKEN'] || 'safdasfjlkj...'
- tptacek 14y agoMake sure your session secret is a long random string (it might be tempting, if you're passing it in through the environment, to make it shorter or readable). It's an HMAC key that anyone who can get a session from your application can dictionary.
- MattRogish 14y agoOh yes. It's probably ridiculously long (I think 256 chars, letters numbers special etc) :)