diff options
author | Dhia Eddine Chouchane <dhiachouchane@gmail.com> | 2015-08-06 09:21:03 +0100 |
---|---|---|
committer | Dhia Eddine Chouchane <dhiachouchane@gmail.com> | 2015-08-06 09:21:03 +0100 |
commit | a42ca131a539a80d687b352a90ad2d665e59e0bc (patch) | |
tree | 4f4822de1725c8e9004009d55fe8b3540ef66a11 /guides | |
parent | 87f0e6719f8646ae5c5fdcad5c1b7757a36c3ed3 (diff) | |
download | rails-a42ca131a539a80d687b352a90ad2d665e59e0bc.tar.gz rails-a42ca131a539a80d687b352a90ad2d665e59e0bc.tar.bz2 rails-a42ca131a539a80d687b352a90ad2d665e59e0bc.zip |
[ci skip] Typo fixed
Diffstat (limited to 'guides')
-rw-r--r-- | guides/source/security.md | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/guides/source/security.md b/guides/source/security.md index edce41516f..c5c0e9bcf6 100644 --- a/guides/source/security.md +++ b/guides/source/security.md @@ -97,7 +97,7 @@ Rails 2 introduced a new default session storage, CookieStore. CookieStore saves However, since Rails 4, the default store is EncryptedCookieStore. With EncryptedCookieStore the session is encrypted before being stored in a cookie. This prevents the user access to the content of the cookie and prevents him from tampering its content as well. Thus the session becomes a more secure place to store data. The encryption is done using a server-side secret key `secrets.secret_key_base` stored in `config/secrets.yml`. -That means the security of this storage depends on this secret (and on the digest algorithm, which defaults to SHA1, for compatibility). So _don't use a trivial secret, i.e. a word from a dictionary, or one which is shorter than 30 characters, use `rake secrets` instead_. +That means the security of this storage depends on this secret (and on the digest algorithm, which defaults to SHA1, for compatibility). So _don't use a trivial secret, i.e. a word from a dictionary, or one which is shorter than 30 characters, use `rake secret` instead_. `secrets.secret_key_base` is used for specifying a key which allows sessions for the application to be verified against a known secure key to prevent tampering. Applications get `secrets.secret_key_base` initialized to a random key present in `config/secrets.yml`, e.g.: |