How to keep the app secret a secret?

问题:

Every new Play app gets a new application secret generated into its config file.

application.secret=asdfadsfdasf

I'm developing an open source app that will be deployed on Heroku. How can I keep the app secret a secret (e.g. no commit it into source control)?

Where exactly is the app secret used? Perhaps for my limited purposes I don't really have to keep it a secret?

回答1:

You can externalize the secret as an environment variable.

In conf/application.conf Simply replace

application.secret=abc123...

with

application.secret=${APP_SECRET}

and then set this config var in Heroku with:

$ heroku config:add APP_SECRET=abc123...

Now you can manage secrets on a per-app basis and avoid checking them into version control.

回答2:

It looks like that secret is important, but you can generate new ones for production vs development. So for development you could check it into SVN then generate a different one for production.

http://www.playframework.org/documentation/1.0/production