ruby-on-rails – 当开源实时Rails应用程序时,将会话密钥保密在

如果危险,人们通常如何处理这个问题？我想最简单的方法就是将字符串移动到SCM忽略的文本文件中,稍后再读取.

为了清楚起见,我在说这个：

# Your secret key for verifying cookie session data integrity.
# If you change this key,all old sessions will become invalid!
# Make sure the secret is at least 30 characters and all random,# no regular words or you'll be exposed to dictionary attacks.
ActionController::Base.session = {
  :key         => '_application_session',:secret      => '(long,unique string)'
}

虽然我们正在研究这个主题,但在开源实时应用程序时,是否应该保护默认Rails应用程序中的其他内容？