A Better Way to Manage the Rails Secret Token

Re:A Better Way to Manage the Rails Secret Token by olalonde on Monday May 20, 2013 @01:17AM (#5736034)

Have you considered generating a key at first startup and storing it in a database? Or would that introduce too much unnecessary overhead while introducing an attack vector through the database?

[ Parent | on HN ]

Re:A Better Way to Manage the Rails Secret Token by rst on Monday May 20, 2013 @09:37AM (#5737628)

The extra overhead could be kept pretty small. After being retrieved once, it can be cached in the memory of a server process. So, there's one short SQL query at process startup (or perhaps first request, depending on how you do it), and negligible overhead after that.

[ Parent | on HN ]

Re:A Better Way to Manage the Rails Secret Token by joevandyk on Monday May 20, 2013 @09:59AM (#5737719)

This is what I do, works great.

Most of my application secrets/configuration/keys/tokens are stored in the database.

The only one that's not is the information about how to connect to the database. That's stored in the DATABASE_URL environment variable and it's stored on each machine. envdir is used to start the apps, reading that environment data.

[ Parent | on HN ]