/config/initializers/secret_token.rb - Diff - Foreman

« Previous | Next »

Revision adfcf8f0

fixes #2109 - improve session token security

- adds security:generate token rake task to create static token
- generate and cache a token on startup if static token isn't present

     # Be sure to restart your server when you modify this file.
     require 'foreman/util'
     include Foreman::Util
     # Your secret key for verifying the integrity of signed cookies.
     # If you change this key, all old signed cookies will become invalid!
     # Make sure the secret is at least 30 characters and all random,
     # no regular words or you'll be exposed to dictionary attacks.
     Foreman::Application.config.secret_token = '1d53dcb00e724f72a15823d6939a2ee6f3b3ab3af7c47d074cefb1c9d3fe197cce3d0e2050a68d593f9275242d01658f3e9badd6221cf0e76e18896e4862358c'
     unless Foreman::Application.config.secret_token
       token_store = Rails.root.join("tmp", "secret_token")
       token = File.read(token_store) if File.exist? token_store
       unless token
         token = secure_token
         File.open(token_store, "w", 0600) { |f| f.write(token) }
       end
       Foreman::Application.config.secret_token = token
     end

Also available in: Unified diff