This add-on is operated by Will
Automatic and Graceful Secure Key Rotation
Last updated 25 June 2015
Table of Contents
Adding automatic key rotation to an application ensures your app always has fresh, unguessable secrets. They can be used anywhere in your application where some sort of entropy is needed. Secure Key promotes best practices by keeping these secrets in your environment (rather than checked into source control) and by rotating them periodically.
This is especially perfect for cookie signing. In this case, you will want to sign all new cookies with the new key, but accept cookies signed with both the new and the old key. This ensures that there is not a discontinuity upon key rotation that causes all users to be logged out.
Secure Key is accessible directly via your applications environment.
Provisioning the add-on
Secure Key can be attached to a Heroku application via the CLI:
$ heroku addons:create securekey Adding securekey on sushi... done, v6 (free) Attached as SECUREKEY_CHARCOAL Use `heroku addons:docs securekey` to view documentation.
Once Secure Key has been added,
SECURE_KEY will be available in the app configuration and will contain the current securely generated keys. This can be confirmed using the
heroku config command.
$ heroku config | grep SECUREKEY SECUREKEY_CHARCOAL_KEY: 2fi9ugflsiscwcdv3g2aq2v2c2nwam2elripnkjbn1s6n5m6c4,6c7r6pz375bhltbvt57slj5waqj3fw1t7hc0u8bqwda0sqdth5
The keys are formatted like
<CURRENT_KEY>,<OLD_KEY>. After the appropriate amount of time,
CURRENT_KEY will move after the comma becoming the old key, and a fresh key will be put before the comma.
$ heroku config | grep SECUREKEY SECUREKEY_CHARCOAL_KEY: 3bxllgq4u28ogxr6yug8hhiuqse3lgzg1zixu7cxrs0prdpw5d,2fi9ugflsiscwcdv3g2aq2v2c2nwam2elripnkjbn1s6n5m6c4
After provisioning the add-on it’s necessary to locally replicate the config vars so your development environment can operate against the service.
Though less portable it’s also possible to set local environment variables using
Use Foreman to configure, run and manage process types specified in your app’s Procfile. Foreman reads configuration variables from an .env file. Use the following command to add the ADDON_CONFIG_NAME values retrieved from heroku config to
$ heroku config -s | grep SECURE_KEY >> .env $ more .env
Credentials and other sensitive configuration values should not be committed to source-control. In Git exclude the .env file with:
echo .env >> .gitignore.
Removing the add-on
Secure Key can be removed via the CLI.
This will destroy all associated data and cannot be undone!
$ heroku addons:destroy SECUREKEY_CHARCOAL -----> Removing securekey from sushi... done, v20 (free)
All Secure Key support and runtime issues should be logged with Heroku Support at https://support.heroku.com. Secure Key is an open source add-on. Any non-support related issues or product feedback is welcome at https://github.com/will/securekey.
Additional resources are available at: