Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.Sign up
Security concerns #2
I'm not mélanchonien but this initiative is quite laudable.
PartiDeGauche::Application.config.secret_token = 'c38ac477282636ad9940105aa8445d626f281ea543def898337c77bbcb2979ffdd62085ad456dd5cf36c35c37ce02ffa21cfdf5bb6f444db86bb43090fe0aa31'
This is called secret for a reason. It is used to sign your cookies. You let your users vulnerable to a session hijacking.
PBX_SITE = "5133308" PBX_SITE_TEST = "1999888"
These are part of a payment gateway credentials. For these ones, you're stuck with them being public, you can't regenerate them. Try calling Paybox.
require "omniauth-facebook" config.omniauth :facebook, "293257790720210", "47c73941bce3de72e4dae13d0dd0b8b0", :strategy_class => OmniAuth::Strategies::Facebook
Here are the APP_ID and APP_SECRET for your facebook app.
Here is a little help. I wanted to talk about SettingsLogic, addressing such issues, so I jumped on the occasion :
About the session secret, you could use this method instead:
It require a initializer: https://github.com/diaspora/diaspora/blob/develop/config/initializers/check_session_secret.rb
A the launch of the application, it check it the secret token is set, if not, it generate it with a rake task.
Diaspora use quite the same way through
The secret token key published here is the original key generated by Rails, but it's not used by production environments. The system uses a method similar to what's proposed here (diaspora) based on Capistrano.
The facebook Id and keycode isn't used by the application and refers to a kind of 'dummy' account that is never used, so those Ids will be cleaned-up. In any case the keys will be managed using Capistrano scripts.
For payment credentials, this refers to a test site in a test mode.
Thank you very much guys for your input here.