Phoenix: Should the signing salt be secret, too?
This is less of an issue and more of a question.
Session cookies are signed with both the signing_salt and the secret_key_base. Is there a reason for not defaulting to keeping the signing_salt secret and different from dev/test (similar to how the prod_secret_key_base is generated for prod.secret.exs)?
If not, I am more than willing to open a PR for my first contribution!
kylekthompson
❤4
>All comments
The secret_key_base is enough as a secret. There are also advantages for keeping them in different places.
josevalim
on 3 Mar 2017
👍3
Was this page helpful?
0 / 5 - 0 ratings
Related issues
imranismail
路
4Comments
oliverandrich
路
3Comments
chrismccord
路
4Comments
tcoopman
路
3Comments
blisscs
路
4Comments
Most helpful comment
The secret_key_base is enough as a secret. There are also advantages for keeping them in different places.