News for hackers. Stuff that matters.

A comment on SQL Injection Vulnerability in Ruby on Rails; affects all versions. Parent comment

Re:SQL Injection Vulnerability in Ruby on Rails; affects all... by mikeryan on Wednesday January 02, 2013 @09:36PM (#5000773)
did you even look at what was matched?

Change the cookie secret token at config/initializers/secret_token.rb

Create a config/initializers/secret_token.rb file:

That will rename your app in the following files: ... config/initializers/secret_token.rb

Change your Application’s Secret Token ...

Change the secret token at /config/initializers/secret_token.rb

Those are the first six items in order and the trend continues at least through the first page of results.

[ Parent | on HN ]
Re:SQL Injection Vulnerability in Ruby on Rails; affects all... by paulgb on Thursday January 03, 2013 @06:45AM (#5001931)
Good catch, I'm glad that it's a best practice. I wasn't trying to shame those projects, I'm not a rubiest so I was just trying to figure out how someone might gain access to a secret token.
[ Parent | on HN ]