BigTom
Hi,
I notice in various live tutorials that they include a step to configure the signing_salt in config.exs. and replace the existing 8 character one.
Is this necessary to make things work (doesn’t seem to be) or simply good practice 'cos an 8 char secret is a bit of a crappy secret? 
Thanks
Tom
Where Next?
Trending in Discussions
Other Trending Topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
ElixirConf EU 2027, 22-23 April, Lisbon & online. Call for Talks and Call for Training open until 15 Dec.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #code-sync
- #discussion
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #ai
- #umbrella
- #elixirconf-us
- #full-time-contract
- #podcasts-by-brainlid
- #blog-post
- #ecto-query
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #elixirconf-eu
- #processes
- #security
- #api
- #forms
- #performance
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Bringing learning, work and compliance together since 1987.
**Building the future of software with AI, trust, and human connection.**
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 3- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
voltone
It’s not a secret, it’s a salt. Most keys in a Phoenix application are derived from the secret_key_base, and each use-case should have a separate salt to ensure they derive unique keys (reusing a key for different use-cases may weaken the security). So as long as you keep you secret_key_base secret and random, the salt values just need to be unique within your application.
BigTom
Fair point.
The underlying point is that it is good practice for each use-case to have a separate salt, not that you must provide it or the live view will not work. So for a throw-away example this step is not strictly necessary.
Is that right?
Thanks
Tom
Exadra37
Still tooooo shooort. That’s the first thing I change in any project I start