Add support for Rails 4.1 secrets. #2835
Conversation
|
Nice! A couple things:
So I guess we can read Rails secret by default and leave What do you think? |
It is possible to override this by setting the `secret_key` manually on the `devise.rb` initializer on your application.
|
@josevalim just updated the PR with the new approach: the |
|
|
|
|
Add support for Rails 4.1 secrets.
|
|
This comment has been minimized.
This comment has been minimized.
|
With the if-condition in devise.rb I got this error: /.rvm/gems/ruby-2.0.0-p247/gems/activesupport-3.2.13/lib/active_support/dependencies.rb:245:in `load': /Users/Magne/Workspace/bloggery/config/initializers/devise.rb:9: syntax error, unexpected '<' (SyntaxError) So it doesn't seem to be as backwards compatible as intended. I fixed it and submitted this pull request: #3451 |
1. Stop provisioning DEVISE_SECRET_KEY since a separate setting for Devise is not needed with modern versions of Devise and Rails 4+ (cf. heartcombo/devise#2835). The devise.rb initializer has been updated to allow the application to start without ENV['DEVISE_SECRET_KEY'], in which case Devise will use Rails.application.config.secret_key_base (controlled by ENV['SECRET_TOKEN']) 2. Allow the script to be run idempotently 3. Check if a Heroku add-on is installed before calling "heroku addons:create" 4. Check if SECRET_TOKEN is set before generating one 5. Use "rake secret" instead of Python for UUID generation, since this is a Rails project 6. Add quotaguard:starter addon (cf. codeforamerica/ohana-api#415)
1. Stop provisioning DEVISE_SECRET_KEY since a separate setting for Devise is not needed with modern versions of Devise and Rails 4+ (cf. heartcombo/devise#2835). The devise.rb initializer has been updated to allow the application to start without ENV['DEVISE_SECRET_KEY'], in which case Devise will use Rails.application.config.secret_key_base (controlled by ENV['SECRET_TOKEN']) 2. Allow the script to be run idempotently 3. Check if a Heroku add-on is installed before calling "heroku addons:create" 4. Check if SECRET_TOKEN is set before generating one 5. Use "rake secret" instead of Python for UUID generation, since this is a Rails project 6. Add quotaguard:starter addon (cf. #415)
This is a first spike for that @josevalim proposed on #2821. Upgrade existing apps will be simple - developers just need to move their keys to the
secrets.yml- but on fresh apps its required to add thesecret_keykey manually. We could still generate a token inside the initializer as a fallback (so the app can boot without this step) or figure out an automatic way of placing the token on the application configuration.