I kinda struggled with this at first too, since I think it's not really that clearly explained in the docs.
Devise usage of secret key
From the Devise repository:
initializer "devise.secret_key" do |app|
if app.respond_to?(:secrets)
Devise.secret_key ||= app.secrets.secret_key_base
elsif app.config.respond_to?(:secret_key_base)
Devise.secret_key ||= app.config.secret_key_base
end
Devise.token_generator ||=
if secret_key = Devise.secret_key
Devise::TokenGenerator.new(
ActiveSupport::CachingKeyGenerator.new(ActiveSupport::KeyGenerator.new(secret_key))
)
end
end
Once Devise.secret_key
is assigned it is used to generate a token, which in turn is used, if I'm not mistaken, for several Devise functionalities such as account confirmation, resetting password and unlocking accouts. All of these require a token which is generated by the code above.
From devise.rb
:
# The secret key used by Devise. Devise uses this key to generate
# random tokens. Changing this key will render invalid all existing
# confirmation, reset password and unlock tokens in the database.
# Devise will use the `secret_key_base` as its `secret_key`
# by default. You can change it below and use your own secret key.
This means you don't have to set a separate secret_key
for Devise to work, because if you have a secret_key_base
, as shown in the code, it'll just default to that. In my case, I just commented out the code, but you're free to even delete the line that assigns config.secret_key
.
Rails usage of secret key
secret_key_base
is used for signing and encrypting cookies, and it's very well explained in this answer.
secret_token.rb
. Which version of Rails you are using?secrets.yml