Expand description
The process-global secret key base used to sign/encrypt cookies (session, flash, signed cookie jar).
An app installs its real secret once at boot with set_key_base (from
config/credentials); until then a fixed dev-insecure default is used so
things work out of the box in development. Never ship the default.
Functions§
- key_
base - The configured secret key base, or the dev-insecure default when unset.
- set_
key_ base - Install the app’s secret key base. Idempotent: a second call is rejected and returns the passed-in secret back. Call once at boot before serving.