Deprecate secret_token, long since usurped by secret_key_base.

See the changelog entry.

Remove `secrets.secret_token` from the bug report templates,
since we don't accept bug reports for Rails versions that
don't support a `secret_key_base`.

[ claudiob & Kasper Timm Hansen ]

2 files changed, 32 insertions, 0 deletions

diff --git a/railties/lib/rails/application.rb b/railties/lib/rails/application.rb
index 24f5eeae87..4fd20185b1 100644
--- a/railties/lib/rails/application.rb
+++ b/railties/lib/rails/application.rb
@@ -6,6 +6,7 @@ require "active_support/core_ext/object/blank"
 require "active_support/key_generator"
 require "active_support/message_verifier"
 require "active_support/encrypted_configuration"
+require "active_support/deprecation"
 require_relative "engine"
 require_relative "secrets"
 
@@ -398,6 +399,11 @@ module Rails
         # Fallback to config.secret_token if secrets.secret_token isn't set
         secrets.secret_token ||= config.secret_token
 
+        if secrets.secret_token.present?
+          ActiveSupport::Deprecation.warn \
+            "`secrets.secret_token` is deprecated in favor of `secret_key_base` and will be removed in Rails 6.0."
+        end
+
         secrets
       end
     end
diff --git a/railties/test/application/configuration_test.rb b/railties/test/application/configuration_test.rb
index c1a80eaeaf..bb8cc0876c 100644
--- a/railties/test/application/configuration_test.rb
+++ b/railties/test/application/configuration_test.rb
@@ -487,6 +487,32 @@ module ApplicationTests
       assert_equal "some_value", Rails.application.message_verifier(:sensitive_value).verify(message)
     end
 
+    test "config.secret_token is deprecated" do
+      app_file "config/initializers/secret_token.rb", <<-RUBY
+        Rails.application.config.secret_token = "b3c631c314c0bbca50c1b2843150fe33"
+      RUBY
+
+      app "production"
+
+      assert_deprecated(/secret_token/) do
+        app.secrets
+      end
+    end
+
+    test "secrets.secret_token is deprecated" do
+      app_file "config/secrets.yml", <<-YAML
+        production:
+          secret_token: "b3c631c314c0bbca50c1b2843150fe33"
+      YAML
+
+      app "production"
+
+      assert_deprecated(/secret_token/) do
+        app.secrets
+      end
+    end
+
+
     test "raises when secret_key_base is blank" do
       app_file "config/initializers/secret_token.rb", <<-RUBY
         Rails.application.credentials.secret_key_base = nil