What is the best way to read the Rails session secret?

Question

I would like to access the Rails session secret programmatically (I am using it to generate a sign-on token).

Here's what I've come up with:

ActionController::Base.session.first[:secret]

This returns the session secret. However, every time you call ActionController::Base.session it adds another entry to an array so you end up with something like this:

[{:session_key=>"_new_app_session", :secret=>"totally-secret-you-guys"}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]

This strikes me as being no good.

Is there a better way to access the session secret?

choonkeat · Answer 1 · 2014-02-20T06:20:52.560

12

For Rails4

Rails.configuration.secret_token
Rails.configuration.secret_key_base

For Rails3

Rails.configuration.secret_token

But if for Rails2.x, like Don Parish mentioned

ActionController::Base.session_options[:secret]

edited Feb 20 '14 at 06:20

answered Feb 01 '11 at 05:27

choonkeat

5,557
2
26
19

I'm getting nil for both. This isn't normal, is it? I have introduced a `config/secrets.yml` file a few days ago, maybe it isn't read? – Joshua Muheim Mar 16 '15 at 12:11
1

The secrets added to that file are accessible via `Rails.application.secrets`. – zenw0lf Mar 06 '16 at 05:21

score 4 · Answer 2 · answered Oct 10 '08 at 17:16

4

Thanks, Jake.

Since the secret doesn't change based on the request or the action, this also works:

ActionController::Base.session_options_for(nil,nil)[:secret]

answered Oct 10 '08 at 17:16

Luke Francl

31,028
18
69
91

score 2 · Accepted Answer · answered Oct 10 '08 at 17:05

2

ActionController::Base.session_options_for(request,params[:action])[:secret]

answered Oct 10 '08 at 17:05

whoisjake

622
4
7

score 1 · Answer 4 · answered Feb 23 '09 at 18:28

1

For Rails 2.3, I've used:

ActionController::Base.session_options[:secret]

answered Feb 23 '09 at 18:28

Cool, that looks cleaner. I'll have to update our code when we upgrade. – Luke Francl Feb 23 '09 at 19:05

score 0 · Answer 5 · answered Feb 01 '11 at 05:47

0

For Rails 3, Rails.configuration is same to Rails.application.config, so Rails.configuration.secret_token acts just as what choonkeat provided.

answered Feb 01 '11 at 05:47

James Chen

10,794
1
41
38

What is the best way to read the Rails session secret?

5 Answers5