Secrets Configuration

Secrets Configuration

By digitally signing all cookies sent to the browser, Rails can detect whether they were tampered with. Rails signs cookies using the value of secret_key_base, which is randomly generated along with your app.

The encrypted file config/credentials.yml.enc is where Rails stores the secret_key_base by default. As this file is encrypted it can safely be stored in version control as long as the master key is kept safe.

Rails uses the config/master.key or alternatively looks for the environment variable ENV["RAILS_MASTER_KEY"] to encrypt/decrypt the credentials file.

To get a new secret:

$ rails secret

Generate a new primary_key from a Rails console:

$ rails console

$ SecureRandom.hex(64)

Edit your encrypted credentials file with the command:

$ EDITOR="vim" bin/rails credentials:edit

master.key

This key is used to decrypt the config/credentials.yml.enc file in Rails. The credentials.yml.enc file is where you store sensitive information, like API keys and database passwords, in an encrypted format. The master.key file is automatically generated by Rails when you create a new Rails application, and it should not be checked into version control. If you lose this key, you won't be able to decrypt your credentials file.

ActiveRecord Encryption

Open your application's configuration file (config/application.rb or the specific environment configuration file in config/environments/ depending on whether you want to set this for all environments or a specific one).

If you're not seeing any ActiveRecord encryption settings in your Rails application configuration, it may be that they haven't been set up yet. Here's how you can add those settings:

Add the following lines to the configuration file:

config.active_record.encryption.configured = true

config.active_record.encryption.primary_key = Rails.application.credentials.active_record_encryption[:primary_key]

config.active_record.encryption.deterministic_key = Rails.application.credentials.active_record_encryption[:deterministic_key]

config.active_record.encryption.key_derivation_salt = Rails.application.credentials.active_record_encryption[:key_derivation_salt]

These lines configure ActiveRecord encryption in your Rails application and set the primary_key, deterministic_key, and key_derivation_salt from your encrypted credentials.

Please note that you should have already added these keys to your encrypted credentials file (config/credentials.yml.enc) as I described in previous responses.

Once you've added these lines to your configuration, restart your Rails application for the changes to take effect.

Keep in mind that you should be careful when working with encryption settings and keys. If these keys are exposed, an attacker could potentially decrypt your sensitive data. So, keep these keys secure and don't commit them to your version control system.

primary_key in ActiveRecord Encryption:

It's used to encrypt and decrypt sensitive data stored in your database. Each time the same value is encrypted with non-deterministic encryption, a different result is produced. This primary_key should be a secure, random string.

In the credentials file, add your new primary_key under active_record_encryption like this: active_record_encryption:

primary_key: your_new_primary_key_here

Save and close the file. This will automatically encrypt and save the file.

After doing this, your primary_key will be set and you should be able to use ActiveRecord encryption without encountering the error message about primary_key not being set.

Please note that this primary_key should be kept secure and not exposed or committed to your version control system. It is used to encrypt and decrypt sensitive data in your database. If it were to be exposed, it could potentially allow an attacker to decrypt your sensitive data.

deterministic_key

Disable ActiveRecord encryption:

Use the without_encryption method from the ActiveRecord::Encryption module. For example, if you have a model called User, and you want to create a new user without encryption, you would do something like this:

ActiveRecord::Encryption.without_encryption do

User.create(email: '[e-mail]', password: 'password')

end

Encryption

The error message indicates that the key_derivation_salt for ActiveRecord encryption has not been configured.

Starting from Rails 7, ActiveRecord has support for encrypting attributes of a model directly.

To configure key_derivation_salt, you need to add it to your credentials.

Rails uses the encrypted credentials for storing application secrets. These credentials are encrypted with a master key, stored in config/master.key.

You can edit the credentials by running:

EDITOR="vim" bin/rails credentials:edit

This will open the credentials file in your chosen editor.

In this file, you can add your active_record_encryption configuration:

active_record_encryption:

master_key: 123abc456def # replace with your actual master key

deterministic_key: 789ghi012jkl # replace with your actual deterministic key

key_derivation_salt: mno345pqr678stu # replace with your actual key derivation salt

Save the file and close it. Your credentials are automatically saved and encrypted.

Remember, you should keep the master.key file safe and not include it in your version control system. If it's compromised, all your credentials can be accessed. You should also make sure to have secure, random values for the keys and salt in your encryption configuration.