SQL Injection Vulnerability in Ruby on Rails; affects all versions

Re:SQL Injection Vulnerability in Ruby on Rails; affects all... by SoftwareMaven on Wednesday January 02, 2013 @09:26PM (#5000747)

That's an interesting issue (Django has the same issue with its SECRET_KEY). If you have an open-source project that utilizes these kinds of technologies, you need to keep your secret key secret.

As it says in the Django settings:

"Make this unique, and don't share it with anybody."

Your web application's security depends on it!

[ Parent | on HN ]

Re:SQL Injection Vulnerability in Ruby on Rails; affects all... by graue on Wednesday January 02, 2013 @10:50PM (#5000946)

Incidentally, this is one reason why the 12-factor app methodology stores configuration in environment variables, not source files. http://www.12factor.net/config

[ Parent | on HN ]