Take the 2-minute tour ×

Many Rails apps use the CookieStore method of storing sessions. The security of this method depends mainly on the security of the session secret key which is defined by default in config/environment.rb:

config.action_controller.session = {
    :session_key => '_some_name_session',
    :secret      => 'long secret key'

Most people including myself keep this file in our SCM repo. Does this mean if I do some work at a coffee shop (or any open wireless connection) and commit my source, someone can sniff this secret and possibly start creating valid sessions for my application? Can't people sniff the files I commit? This seems like a pretty decent security hole.

share|improve this question
add comment

2 Answers

If you're committing over a protocol other than https or SSH, then yes I believe so. If the person controlling your remote repository server is using port 80 instead of 443, I'd sit down and have a discussion with them.

share|improve this answer
ok...i guess ssh must use a two way encryption function so that the receiver can decrypt the data. so i guess a sniffer would also be able to decrypt data transmitted over ssh? –  Tony Jul 13 '09 at 18:58
It would be extremely difficult. Depending on the key strength used, it generally wouldn't be worth the person's time to sniff and attempt to decrypt the traffic, especially without having the private key. HTTPS is a little easier to crack, but generally if someone wanted your session key that badly they'd either attempt to get it from your repository checked out on your laptop or hack your server directly. –  MattC Jul 13 '09 at 19:02
add comment

Not necessarily. If you're talking to Subversion you can choose to use an HTTPS address rather than an HTTP one and all the communications between your local machine and the version control server will be secure.

I'd be very surprised if Git and Mercurial didn't offer the same ability.

share|improve this answer
Git and Hg both allow communication over HTTPS, or another secure method like SSH. –  mipadi Jul 13 '09 at 18:45
add comment

Your Answer


