For Rails apps, keeping your environment.rb file in your repository seems unsecure...

Question

Many Rails apps use the CookieStore method of storing sessions. The security of this method depends mainly on the security of the session secret key which is defined by default in config/environment.rb:

config.action_controller.session = {
    :session_key => '_some_name_session',
    :secret      => 'long secret key'
}

Most people including myself keep this file in our SCM repo. Does this mean if I do some work at a coffee shop (or any open wireless connection) and commit my source, someone can sniff this secret and possibly start creating valid sessions for my application? Can't people sniff the files I commit? This seems like a pretty decent security hole.

Answer 1

If you're committing over a protocol other than https or SSH, then yes I believe so. If the person controlling your remote repository server is using port 80 instead of 443, I'd sit down and have a discussion with them.

Answer 2

Not necessarily. If you're talking to Subversion you can choose to use an HTTPS address rather than an HTTP one and all the communications between your local machine and the version control server will be secure.

I'd be very surprised if Git and Mercurial didn't offer the same ability.