Skip to content

Require credentials key in production#377

Merged
werebus merged 1 commit into
mainfrom
werebus/require-prod-creds
May 29, 2026
Merged

Require credentials key in production#377
werebus merged 1 commit into
mainfrom
werebus/require-prod-creds

Conversation

@werebus

@werebus werebus commented May 29, 2026

Copy link
Copy Markdown
Member

lib/application_secrets.rb assumes they'll be there in 'prod'

In reviewing #342, I built a "production" container locally without realizing that I was missing the .key file and got:

        SECURITY WARNING: No secret option provided to Rack::Session::Cookie.
        This poses a security threat. It is strongly recommended that you
        provide a secret to prevent exploits that may be possible from crafted
        cookies. This will not be supported in future versions of Rack, and
        future versions will even invalidate your existing user cookies.

We shouldn't boot with blank secrets

`lib/application_secrets.rb` assumes they'll be there in 'prod'
@werebus werebus merged commit b753e6a into main May 29, 2026
1 check passed
@werebus werebus deleted the werebus/require-prod-creds branch May 29, 2026 19:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants