As far as I know, secret_key_base is only used for signing cookies and changing secret_key_base will cause existing cookies to become invalid. I need to change secret_key_base on production, having existing users logged out is acceptable behavior but I am concerned about possible other side effects. Will the old cookies simply be deleted/replaced when they next visit the website or will they hang around and cause issues? Are there any other changes that will occur other than users being logged out?
2 Answers
The application’s key_generator, and thus secret_key_base, are used by three core features within the Rails framework:
1 Deriving keys for encrypted cookies which are accessible via cookies.encrypted.
2 Deriving the key for HMAC signed cookies which are accessible via cookies.signed.
3 Deriving keys for all of the application’s named message_verifier instances.
you can read more at https://medium.com/@michaeljcoyne/understanding-the-secret-key-base-in-ruby-on-rails-ce2f6f9968a1
The impact of your application by changing the secret_key_base on prod will depend on how many cookies your application depends on. I would say all your clients will have to regenerate their cookies 1 time after that it should be back to normal.
The secret_key_base can be upgraded in a rotating way, with no impact to the users. I have found a tutorial on how to do this here.
This seems to work, and following this tutorial, I was able to install an automated periodic renew of the secret_key_base, per scheduler, with configurable timespan. Only if users stay inactive for longer than that timespan (e.g. 3 months), their session will become invalid.
This applies to the standard rails functionality of protecting the session-cookie. If your application does other things with the secret_key_base, then you will have to process respective rotations there also.
Related