jasonshen/RewardBox — pull request #3 by prezjordan (2013-05-10 23:24:28+00:00)
Title: Removing secret token and replacing with rake task

This fixes the same issue (as I've just discovered) as #1. Check out this blog post, which points out why Rails' default secret_token is inherently insecure: http://blog.codeclimate.com/blog/2013/03/27/rails-insecure-defaults/

This pull request does a few things:

* Removes the hard-coded "secret" token
* Adds a rake task (`rake development:generate_secret_token`) which generates a token file `secret.token`, which is ignored by git
* Changes `secret_token.rb` to read from this file in development mode (and errors out with a message if this file does not exist). In production mode, `secret_token.rb` reads from the environment variable, `REWARDBOX_TOKEN`

If you choose to accept this pull request, you'll need to do the following:

* Run `rake development:generate_secret_token`. Your application will error out with instructions if you don't
* On Heroku, you'll need to add an environment variable like so:

heroku config:set REWARDBOX_TOKEN=`rake secret`

That should be it! Feel free to hit me up with any questions or concerns.