How do I encrypt OAuth secret/tokens in my rails database?

Question

I have a Ruby on Rails App (v4.0.1 though I don't think that's relevant here) running on Ruby 2.0 and I allow users to OAuth into third party services to give me access to their data.

I have stored my application's Consumer Key and Consumer Secret in environment variables that are outside of source control.

After the last callback in the OAuth / OAuth2 dance, I have tokens for each of my users which can be used to access their information.

For their login credentials I use one way hashing to not have their passwords stored in my database in plain text, so I'm figuring I should do something similar with their tokens, but since I need to use those tokens to access their data, I need to be able to reproduce the plain text, so I'm trying to figure out what's the best way to do symmetric encryption.

I'm planning on storing my encryption key as an environment variable and then using something like https://gist.github.com/nono/2995118 to encrypt the tokens. Is this secure?

Have people used this https://github.com/reidmorrison/symmetric-encryption gem?

I'm trying to prevent myself from having to reinvent the wheel. Any tips?

Answer 1

I ended up using the attr_encrypted gem - https://github.com/attr-encrypted/attr_encrypted

and I added my passphrase to my .env file so that it is not under version control.

Here's how you use it:

attr_encrypted :email, :key => 'a secret key'

Answer 2

django-allauth is no slacker of a OAuth(2) implementation. I'm looking at its socialaccount_socialtoken table now, and the tokens are all in cleartext. I think you are covered, because nobody could use the tokens if they stole them.