codeforamerica/brigade — pull request #254 by daguar (2013-09-14 17:22:23+00:00)
Title: Put secret token in env variable in production

This PR patches the app to protect against a remote code execution vulnerability when a Rails app's secret key is available to the world (eg, in open source). For more detail, see: http://www.phenoelit.org/stuff/tokenfaq.html

After accepting the PR, you'll have to take a few additional steps to secure the current production deployment:

1. Run `rake secret` from the local app directory (generates a new secret token)
2. Take the output of that command, and store it in an environment variable called `SECRET_TOKEN` on the production server

For illustration, if you're deployed on Heroku, this is fairly easy:
`heroku config:set SECRET_TOKEN=thenewlygeneratedkeygoeshere`

Otherwise follow whatever procedure is needed for the deployment environment you have to set an environment variable.

(Note: I have not provided test coverage in this PR, but I have tested locally with `RAILS_ENV=production rails s` with successful running. Adding a token env variable on the Travis CI server may also be necessary.)