# Secrets Configuration

Secrets Configuration

By digitally signing all cookies sent to the browser, Rails can detect whether they were tampered with. Rails signs cookies using the value of secret\_key\_base, which is randomly generated along with your app.

The encrypted file config/credentials.yml.enc is where Rails stores the secret\_key\_base by default. As this file is encrypted it can safely be stored in version control as long as the master key is kept safe.

Rails uses the config/master.key or alternatively looks for the environment variable ENV\["RAILS\_MASTER\_KEY"] to encrypt/decrypt the credentials file.

**To get a new secret:**

$ rails secret

**Generate a new primary\_key from a Rails console:**

$ rails console

$ SecureRandom.hex(64)

**Edit your encrypted credentials file with the command:**

$ EDITOR="vim" bin/rails credentials:edit

### master.key

This key is used to decrypt the config/credentials.yml.enc file in Rails. The credentials.yml.enc file is where you store sensitive information, like API keys and database passwords, in an encrypted format. The master.key file is automatically generated by Rails when you create a new Rails application, and it should not be checked into version control. If you lose this key, you won't be able to decrypt your credentials file.

### ActiveRecord Encryption

Open your application's configuration file (config/application.rb or the specific environment configuration file in config/environments/ depending on whether you want to set this for all environments or a specific one).

If you're not seeing any ActiveRecord encryption settings in your Rails application configuration, it may be that they haven't been set up yet. Here's how you can add those settings:

Add the following lines to the configuration file:\


config.active\_record.encryption.configured = true

config.active\_record.encryption.primary\_key = Rails.application.credentials.active\_record\_encryption\[:primary\_key]

config.active\_record.encryption.deterministic\_key = Rails.application.credentials.active\_record\_encryption\[:deterministic\_key]

config.active\_record.encryption.key\_derivation\_salt = Rails.application.credentials.active\_record\_encryption\[:key\_derivation\_salt]

These lines configure ActiveRecord encryption in your Rails application and set the primary\_key, deterministic\_key, and key\_derivation\_salt from your encrypted credentials.

Please note that you should have already added these keys to your encrypted credentials file (config/credentials.yml.enc) as I described in previous responses.

Once you've added these lines to your configuration, restart your Rails application for the changes to take effect.

Keep in mind that you should be careful when working with encryption settings and keys. If these keys are exposed, an attacker could potentially decrypt your sensitive data. So, keep these keys secure and don't commit them to your version control system.

#### primary\_key in ActiveRecord Encryption:

It's used to encrypt and decrypt sensitive data stored in your database. Each time the same value is encrypted with non-deterministic encryption, a different result is produced. This primary\_key should be a secure, random string.

In the credentials file, add your new primary\_key under active\_record\_encryption like this:\
active\_record\_encryption:

primary\_key: your\_new\_primary\_key\_here

Save and close the file. This will automatically encrypt and save the file.

After doing this, your primary\_key will be set and you should be able to use ActiveRecord encryption without encountering the error message about primary\_key not being set.

Please note that this primary\_key should be kept secure and not exposed or committed to your version control system. It is used to encrypt and decrypt sensitive data in your database. If it were to be exposed, it could potentially allow an attacker to decrypt your sensitive data.

#### deterministic\_key

#### Disable ActiveRecord encryption:

Use the without\_encryption method from the ActiveRecord::Encryption module. For example, if you have a model called User, and you want to create a new user without encryption, you would do something like this:

ActiveRecord::Encryption.without\_encryption do

User.create(email: 'test@example.com', password: 'password')

end



### Encryption

The error message indicates that the key\_derivation\_salt for ActiveRecord encryption has not been configured.

Starting from Rails 7, ActiveRecord has support for encrypting attributes of a model directly.

To configure key\_derivation\_salt, you need to add it to your credentials.

Rails uses the encrypted credentials for storing application secrets. These credentials are encrypted with a master key, stored in config/master.key.

You can edit the credentials by running:

EDITOR="vim" bin/rails credentials:edit

This will open the credentials file in your chosen editor.

In this file, you can add your active\_record\_encryption configuration:

active\_record\_encryption:

master\_key: 123abc456def # replace with your actual master key

deterministic\_key: 789ghi012jkl # replace with your actual deterministic key

key\_derivation\_salt: mno345pqr678stu # replace with your actual key derivation salt

Save the file and close it. Your credentials are automatically saved and encrypted.

Remember, you should keep the master.key file safe and not include it in your version control system. If it's compromised, all your credentials can be accessed. You should also make sure to have secure, random values for the keys and salt in your encryption configuration.
