With each update, the credentials feature acquired better shape. This post will offer a peek into the evolution of encrypted credentials since its inception in Rails 5.1
Your blog The concept of encrypted secrets evolved and acquired a better shape with each update of the Rails version. Recently, Rails 6.2 has brought in many such updates to the credentials feature. Let us analyze and discuss encrypted credentials further, how to read them, the advantages, and finally, how to manage a secret key base.
Evolution of Encrypted credentials
Encrypted secrets were introduced with Rails 5.1 in a view to bringing more security to the secrets handled. In this version, these were referred to as ‘ secrets ‘ and were referenced by
The secrets.yml.enc file handles the secrets along with an encryption key.
Handling secrets before Rails 5.1
Before this version of Rails, there were two methods to commit the secrets.
Handling secrets in Rails 5.1
By default, from this version of Rails, the secrets were passed as secrets.yml file along with an encryption key. Without this key, the secrets stored in the file will look like some junk characters. To initiate using secrets, the user needs to run:
This would create two files: config/secrets.yml.key and config/secrets.yml.enc. The key file will hold the secret key to decrypt data in the enc file.
Encrypted Credentials in Rails 5.2
An update to the older secret handling, this Rails version removed plain text secrets, and only encrypted credentials were allowed. Credentials were stored in config/credentials.yml.enc, and the key was stored on config/master.key. Thus users could deploy code and credentials together and store all credentials in one place.
Here, multi-environment credentials were handled by specifying explicitly, and the configuration was accessed by mentioning the access_key_id.
Encrypted Multi-environment Credentials in Rails 6.1
The latest update made it to separate credential files for each environment. This built-in feature necessitates a separate encryption key for each credential file, thus guaranteeing more security.
A global credential file is enough for multiple environments. And when the environment is passed, two files would be created:
Here’s an example of how it works:
If the environment file is missing or not created, the default credentials.yml.enc file will be used.
Also, the config/credential/prod.yml.enc file would be committed to the repository, whereas the config/credential/prod.key file would not.
Add-ons in Rails 6
Make sure to save the valid key and the credentials to avoid errors while running the code.
Our latest guide Rails encrypted credentials on 6.2 offers an interesting peek into the Rails credentials.
Advantages of encrypted credentials
The main advantages of encrypted multi-environment credentials are as follows:
Rails is constantly improving the efficiency and scalability of the framework. With the multi-environment credentials enabled, applications used in multiple platforms and POD find it easier to keep the codes simple and accessible.
Know how to use Engine Yard Kontainers to connect to your database, enabling the Rails credentials for improved security.
To learn more about the older versions of credentials, check out Encrypted Rails Secrets on Rails 5.1