Add in your repo: a template of it (secret_token.rb.template), a script able to generate a proper config file secret_token.rb based on local data found on the server (like an encrypted file with the secret value ready to be decoded and put in the secret_token.rb file) From there, add a git attribute custom driver: The script … Read more
I’ve been playing with tokens for my application as well. While I’m not an expert by any means, I can share some of my experiences and thoughts on the matter. The point of JWTs is essentially integrity. It provides a mechanism for your server verify that the token that was provided to it is genuine … Read more
There is no right or wrong answer. There are numerous factors to consider: If this is for/in G-Suite, then your G-Suite admins’ll have (or can get) access to anything. This may or may not be an issue. If you put the data in a sheet, anyone that has read access to the sheet can see … Read more
Let me try to break down your question to multiple subquestions/assumption: Assumptions: a) Keychain is safe place Actually, it’s not that safe. If your application is installed on jailbroked device, a hacker will be able to get your keys from the keychain Questions: a) Is there a way to put some key into an app … Read more
Crazy as it sounds, this is probably the best solution. Everything else is more complicated, but not much more secure. Any fancy obfuscation techniques you use are just going to be reverse engineered almost as quickly as they’ll find this key. But this static key solution, while wildly insecure, is nearly as secure than the … Read more
If you use a block-chaining mode like CBC, you need to provide an IvParameterSpec to the Cipher as well. So you can initialize an IvParameterSpec like this: // build the initialization vector. This example is all zeros, but it // could be any value or generated using a random number generator. byte[] iv = { … Read more