is rails "secret_token" still important with config.session_store(:cache_store)?
ruby-on-rails, ruby-on-rails-3
Solution
The secret_token is used by the cookie_store, used to store session data client side. Here is a nice write-up of how to execute arbitrary code using a known secret_token.
This `cookie_store` is more precisely `ActionDispatch::Session::CookieStore`, a rack middleware that rails loads into your rack stack when you set `session_store(:cookie_store)`. So if you're setting that to `:session_store` you should be fine not setting secret_token.
You can examine `Rails.configuration.middleware` to see all your middlewares and confirm `ActionDispatch::Session::CookieStore` is not one of them.
FWIW, a rails 3.2 app will start with `secret_token` not set, but requests that try to set session variables will fail 500. I haven't tracked down exactly where the failure happens.
But if you're not setting secret_token, and you don't have `ActionDispatch::Session::CookieStore` in your rack stack, and your app appears to work, you are safe from that particular attack.
The other use of `secret_token` is digest authentication.
In summary, to answer the question, if you're not using digest authentication, and you don't use cookie_store (e.g., by setting `session_store(:cache_store)`), then `secret_token` is not important.
Problem
i've done my google due diligence and can't find an explicit answer. so, good people of stack overflow... if, in a rails 3 app, i'm not using cookies to store sessions, is it important to securely manage the "Application.config.secret_token"? furthermore, it is used at all?