Merge pull request #8581 from garysweaver/security_guide_update

Update security guide

guides/source/security.md

@@ -94,17 +94,16 @@ Rails 2 introduced a new default session storage, CookieStore. CookieStore saves
 
 * The client can see everything you store in a session, because it is stored in clear-text (actually Base64-encoded, so not encrypted). So, of course, _you don't want to store any secrets here_. To prevent session hash tampering, a digest is calculated from the session with a server-side secret and inserted into the end of the cookie.
 
-That means the security of this storage depends on this secret (and on the digest algorithm, which defaults to SHA512, which has not been compromised, yet). So _don't use a trivial secret, i.e. a word from a dictionary, or one which is shorter than 30 characters_. Put the secret in your environment.rb:
+That means the security of this storage depends on this secret (and on the digest algorithm, which defaults to SHA512, which has not been compromised, yet). So _don't use a trivial secret, i.e. a word from a dictionary, or one which is shorter than 30 characters_.
 
-```ruby
-config.action_dispatch.session = {
-  key:    '_app_session',
-  secret: '0x0dkfj3927dkc7djdh36rkckdfzsg...'
-}
-```
+Newly generated applications get their `config.secret_key_base` (or in `environment.rb` in some past versions) initialized to a random key in `config/initializers/secret_token.rb`, e.g.:
+
+    Posts::Application.config.secret_token = 'dkfj3927dkc7djdh36rkckdfzsg...'
 
 There are, however, derivatives of CookieStore which encrypt the session hash, so the client cannot see it.
 
+If you have received an application where the secret was exposed (e.g. an application whose source was shared), strongly consider changing the secret.
+
 ### Replay Attacks for CookieStore Sessions
 
 TIP: _Another sort of attack you have to be aware of when using `CookieStore` is the replay attack._
@@ -959,6 +958,11 @@ Used to control which sites are allowed to bypass same origin policies and send
 * Strict-Transport-Security
 [Used to control if the browser is allowed to only access a site over a secure connection](http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security)
 
+Environmental Security
+----------------------
+
+It is beyond the scope of this guide to inform you on how to secure your application code and environments. However, please secure your database configuration, e.g. `config/database.yml`, and your server-side secret, e.g. stored in `config/initializers/secret_token.rb`. You may want to further restrict access, using environment-specific versions of these files and any others that may contain sensitive information.
+
 Additional Resources
 --------------------