when you have secret key in your project, how can pushing to GitHub be possible?

git github secret-key
nonopolarity picture nonopolarity · Feb 27, 2011 · Viewed 10.9k times · Source

I am trying to push a brand new, empty Rail 3.0.4 project to GitHub, but just realize that the cookie session store has a secret key:

In config/initializers/secret_token.rb

NewRuby192Rails304Proj::Application.config.secret_token = '22e8...'

So how can we avoid it being push to GitHub? We can ignore this file (using .gitignore), but without this file, a Rails app won't run at all (and is not a complete Rails app). Or in general, other files or frameworks may have files containing secret keys too. In such case, how should it be handled when pushing to GitHub?

Answer

VonC picture VonC · Feb 27, 2011

Add in your repo:

  • a template of it (secret_token.rb.template),
  • a script able to generate a proper config file secret_token.rb based on local data found on the server (like an encrypted file with the secret value ready to be decoded and put in the secret_token.rb file)

From there, add a git attribute custom driver:

enter image description here

The script referenced above will be your 'smudge' script which will, on checkout of the working tree, generate automatically the right file.

Related questions

Making a Git project open source when you have secret keys

I have a project on GitHub behind a private repository. I want to make the repo public. However, my project uses secret keys. How can I make the project public while still protecting the "history" of those secret keys? I'm …

Read More
How can I determine the URL that a local Git repository was originally cloned from?

I pulled a project from GitHub a few days ago. I've since discovered that there are several forks on GitHub, and I neglected to note which one I took originally. How can I determine which of those forks I pulled?

Read More
Git pull a certain branch from GitHub

I have a project with multiple branches. I've been pushing them to GitHub, and now that someone else is working on the project I need to pull their branches from GitHub. It works fine in master. But say that someone …

Read More