René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Encrypt your data with MessageEncryptor","articleBody":"Rails has a built-in class [MessageEncryptor](http://api.rubyonrails.org/classes/ActiveSupport/MessageEncryptor.html), which uses [OpenSSL::Cipher](http://ruby-doc.org/stdlib-2.2.3/libdoc/openssl/rdoc/OpenSSL/Cipher.html) to perform encryption. Read [How does MessageEncryptor works](http://www.monkeyandcrow.com/blog/reading_rails_how_does_message_encryptor_work) or [the source code](https://github.com/rails/rails/blob/4f51433/activesupport/lib/active_support/message_encryptor.rb) if you are interested in its inner workings.\n\nIf you have been working with Ruby for a while, you would probably be familiar with `attr_accessor`, `attr_reader` and `attr_writer` which provide you with getter and/or setter. These methods are mostly convenient, but if you are required to store sensitive information in the database (i.e. OAuth token), then you will need your own custom getter and setter to protect the sensitive data.\n\nYou can make use of the `#encrypt_and_sign` and `#decrypt_and_verify` methods available in Rails to encrypt and decrypt data in your custom getter and setter, and here's how you can do it:\n\n``` ruby\ndef token=(value)\n  encrypted_token = cryptor.encrypt_and_sign(value)\n  self[:token] = encrypted_token\nend\n\ndef token\n  encrypted_token = self[:token]\n\n  if encrypted_token.present?\n    cryptor.decrypt_and_verify(encrypted_token)\n  end\nend\n\nprivate\n\n  def cryptor\n    ActiveSupport::MessageEncryptor.new(Rails.application.secrets.secret_key_base)\n  end\n```\n\nFeeling paranoid? You can also pass in additional cipher:\n\n``` ruby\nActiveSupport::MessageEncryptor.new(\n  Rails.application.secrets.secret_key_base,\n  cipher: \"aes-256-ecb\"\n)\n```\n\nPro-tip: You can get a list of available ciphers with `$ openssl list-cipher-commands`.\n\nTesting it is also very simple (with RSpec):\n\n``` ruby\ndescribe \"#token=\" do\n  it \"saves encrypted token in database\" do\n    user = build(:user)\n    user.token = \"oauth token\"\n\n    user.save\n\n    expect(user[\"token\"]).not_to eq(\"oauth token\")\n  end\nend\n\ndescribe \"#token\" do\n  it \"returns decrypted token upon retrieval\" do\n    user = build(:user)\n    user.token = \"oauth token\"\n\n    user.save\n\n    expect(user.reload.token).to eq(\"oauth token\")\n  end\nend\n```\n\nNote that I have used [FactoryGirl](https://github.com/thoughtbot/factory_girl) to perform a `build(:user)`. \n\nAlternatively, if you need a lot more features for your encrypted fields, you can also check out [attr_encrypted gem](https://github.com/attr-encrypted/attr_encrypted).\n\nRemember to secure sensitive information you store in your database! :heart:\n## \n\nThanks for reading! \n\n@JuanitoFatas :pencil2: [Jolly Good Code](http://www.jollygoodcode.com)\n### About Jolly Good Code\n\n[![Jolly Good Code](https://cloud.githubusercontent.com/assets/1000669/9362336/72f9c406-46d2-11e5-94de-5060e83fcf83.jpg)](http://www.jollygoodcode.com)\n\nWe specialise in Agile practices and Ruby, and we love contributing to open source. \n[Speak to us](http://www.jollygoodcode.com/#get-in-touch) about your next big idea, or [check out our projects](http://www.jollygoodcode.com/open-source).  \n","author":{"url":"https://github.com/JuanitoFatas","@type":"Person","name":"JuanitoFatas"},"datePublished":"2015-11-17T07:47:23.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/10/jollygoodcode.github.io/issues/10"}