/ - Diff - Foreman

« Previous | Next »

Revision adfcf8f0

fixes #2109 - improve session token security

- adds security:generate token rake task to create static token
- generate and cache a token on startup if static token isn't present

.gitignore
		config/settings.yaml
		config/email.yaml
		config/database.yml
		config/initializers/local_secret_token.rb
		Gemfile.lock
		bundler.d/Gemfile.local.rb
		*.sw?

     # Be sure to restart your server when you modify this file.
     # Your secret key for verifying the integrity of signed cookies.
     # If you change this key, all old signed cookies will become invalid!
     # Make sure the secret is at least 30 characters and all random,
     # no regular words or you'll be exposed to dictionary attacks.
     # You can use `rake security:generate_token` to regenerate this file.
     #Foreman::Application.config.secret_token = 'uncomment and insert token here'

     # Be sure to restart your server when you modify this file.
     require 'foreman/util'
     include Foreman::Util
     # Your secret key for verifying the integrity of signed cookies.
     # If you change this key, all old signed cookies will become invalid!
     # Make sure the secret is at least 30 characters and all random,
     # no regular words or you'll be exposed to dictionary attacks.
     Foreman::Application.config.secret_token = '1d53dcb00e724f72a15823d6939a2ee6f3b3ab3af7c47d074cefb1c9d3fe197cce3d0e2050a68d593f9275242d01658f3e9badd6221cf0e76e18896e4862358c'
     unless Foreman::Application.config.secret_token
       token_store = Rails.root.join("tmp", "secret_token")
       token = File.read(token_store) if File.exist? token_store
       unless token
         token = secure_token
         File.open(token_store, "w", 0600) { |f| f.write(token) }
       end
       Foreman::Application.config.secret_token = token
     end

     require 'securerandom'
     module Foreman
       module Util
         # searches for binaries in predefined directories and user PATH
-...
           logger.warn e
           return false
         end
         # Generates a URL-safe token for use with Rails for signing cookies
         def secure_token
           SecureRandom.base64(96).tr('+/=', '-_*')
         end
       end
     end

     require 'foreman/util'
     namespace :security do
       desc 'Generate new security token'
       task :generate_token do
         include Foreman::Util
         File.open("config/initializers/local_secret_token.rb", "w") do |fd|
           fd.write("# Be sure to restart your server when you modify this file.
     # Your secret key for verifying the integrity of signed cookies.
     # If you change this key, all old signed cookies will become invalid!
     # Make sure the secret is at least 30 characters and all random,
     # no regular words or you'll be exposed to dictionary attacks.
     # You can use `rake security:generate_token` to regenerate this file.
     Foreman::Application.config.secret_token = '#{secure_token}'
     ")
         end
       end
     end

Also available in: Unified diff