Security Expose: Assume folks have seen this -

Al12 · December 21, 2012, 5:47pm

FYI

Gary_Weaver · December 21, 2012, 6:49pm

I was concerned when I saw the title of the message, but I think the solution is as simple as just informing people to be sure that any README for Rails apps they share on GitHub (or wherever they have that token exposed), that the user of the application should change that token to a sufficiently random token, and that they should follow the security guide at Securing Rails Applications — Ruby on Rails Guides as well as keeping up with everything they can as it relates to security.

In the current release version of Rails (3.2.9), the file that Rails generates resides in: config/initializers/secret_token.rb

Unfortunately, it looks like the guide in 3.2.9 and master still refer to setting that value in environment.rb, even though it is set via config/initializers/secret_token.rb:

github.com

rails/rails/blob/main/guides/source/security.md

**DO NOT READ THIS FILE ON GITHUB, GUIDES ARE PUBLISHED ON https://guides.rubyonrails.org.**

Securing Rails Applications
===========================

This manual describes common security problems in web applications and how to avoid them with Rails.

After reading this guide, you will know:

* All countermeasures _that are highlighted_.
* The concept of sessions in Rails, what to put in there and popular attack methods.
* How just visiting a site can be a security problem (with CSRF).
* What you have to pay attention to when working with files or providing an administration interface.
* How to manage users: Logging in and out and attack methods on all layers.
* And the most popular injection attack methods.

--------------------------------------------------------------------------------

Introduction
------------

This file has been truncated. show original

However, the “configuring” section in 3.2.9 and master were updated to indicate that config/initializers/secret_token.rb is the place where that is stored and that it is randomly generated, per: “Applications get config.secret_key_base initialized to a random key in config/initializers/secret_token.rb.” https://github.com/rails/rails/blob/master/guides/source/configuring.md

It may be good to add in the guide that puppet, chef, capistrano, or whatever you use to deploy/setup could be used to copy an environment-specific version of that file and to guard it and config/database.yml with your life, if security is a concern, which it usually is.

Thanks for bringing this up, because it is a good idea to mention it for those sharing apps, and because it should probably be clearer in the Rails guide.

Unless someone else is messing with the guide, I could update security page to note the secret_token.rb file vs. use of environment.rb and to note that for a greater (suggested) level of security, database.yml and secret_token.rb should be copied during deploy and be specific for that environment. I don’t think that is overly opinionated as a basic level of security, is it?

fxn · December 21, 2012, 6:59pm

Please go ahead!

Gary_Weaver · December 21, 2012, 8:03pm

Done: Update security guide by garysweaver · Pull Request #8581 · rails/rails · GitHub

fxn · December 21, 2012, 8:08pm

That was quick :), thanks very much Gary!

Gary_Weaver · December 21, 2012, 9:09pm

You’re welcome!