secret_key_base in Rails 6.0 best practices

user_1182464 0
Viewed 809

In Previous rails versions, the secrets file wasn't encrypted. So the best practice was to read, e.g. secret_key_base, from the environment.

This makes sense and it was pretty simple:

# config/secrets.yml

# Do not keep production secrets in the repository,
# instead read values from the environment.
production:
  secret_key_base: <%= ENV["SECRET_KEY_BASE"] %>

The Secrets served then as a simple logical directory for the keys.

in Rails 6.0 the file is encrypted and is not parsed, which means it must contain hard coded strings, i.e. the real secrets.

Is the best practice to have the value hardcoded and use the same key for all environments? This doesn't seem right.

encryption ruby-on-rails configuration
1 Answers

When secure credentials where introduced in 5.2 you only had a single credentials file.

By popular demand Rails 6 will load a seperate config/credentials/*.yml.enc file - where * is the name of the environment if the file is present. This file takes complete precedence over config/credentials.yml.enc - the two are not merged.

You can edit the credentials for a specific environment by passing the environment option:

rails credentials:edit --environment development

See:

user_5448250
Related