我有一个Rails应用程序已经运行了一段时间,我打算在不久的将来开源它.我想知道在应用程序运行时将会话密钥库保密在源代码管理中是多么危险.
如果危险,人们通常如何处理这个问题？我想最简单的方法就是将字符串移动到SCM忽略的文本文件中,稍后再读取.
为了清楚起见,我在说这个：
# Your secret key for verifying cookie session data integrity.
# If you change this key,all old sessions will become invalid!
# Make sure the secret is at least 30 characters and all random,# no regular words or you'll be exposed to dictionary attacks.
ActionController::Base.session = {
:key => '_application_session',:secret => '(long,unique string)'
}