Simple ActiveRecord attributes encryption in Rails 5+

Question

The task at hand was to ensure that certain columns in the database are encrypted in case the database data is stolen. I have a feeling that a lot can be improved here (naming, DSL, encapsulations) while keeping the functionality as simple as it is. Let me know what you think, I'd appreciate any suggestions and ideas!

application_record.rb

class ApplicationRecord < ActiveRecord::Base
  extend Encryptable
  #...
end

encryptable.rb

module Encryptable
  def encrypt_columns(*columns)
    columns.each do |column|
      if self.column_names.include?(column.to_s)
        define_method "#{column}=" do |value|
          self[column] = self.class.crypt.encrypt_and_sign(value)
        end

        define_method "#{column}" do
          self.class.crypt.decrypt_and_verify(self[column])
        end
      end
    end
  end

  def crypt
    salt = '"\xCA)P\x9Dbc\xF7\x85B\xF3v}*p\xA6~\xBAR\xC1K\xE3\x88\xB8\x18\xF7\xD1\xB6e0\x98\xEF \xB9%\xB3\x12\x9C\xFE,\x89\xF4\xDE\xED!:7\xAE<q\xB1.<~\xA3m\e\x8C\t\xCF&/3\xCE\xAE"'
    key = ActiveSupport::KeyGenerator.new('password').generate_key(salt)

    @crypt ||= ActiveSupport::MessageEncryptor.new(key)
  end
end

user.rb

class User < ApplicationRecord
  encrypt_columns :email, :social_security_number
end

\$\begingroup\$ Step 1: Don't hard-code your salt and password... \$\endgroup\$

Flambino
– Flambino

2016-08-31 15:44:41 +00:00
Commented Aug 31, 2016 at 15:44 — Flambino
– Flambino, Commented Aug 31, 2016 at 15:44

tokland · Accepted Answer · 2020-09-25 11:17:37Z

2

Some notes:

The recommended way to overwrite accessors is to use super.
As @Flambino says, it's better not to hardcode secrets directly in the code. It can be a file not committed to the repository.

I'd write the crypt method this way:

  def crypt
    @crypt ||= begin
      key = ActiveSupport::KeyGenerator.new('password').generate_key('salt')    
      ActiveSupport::MessageEncryptor.new(key)
    end
  end

edited Sep 25, 2020 at 11:17

answered Aug 31, 2016 at 20:37

tokland

11.2k1 gold badge21 silver badges26 bronze badges

Add a comment |

Ram on Rails · Accepted Answer · 2016-09-07 21:16:46Z

2

There is already a gem for encrypting data at rest. Does this work for you? https://github.com/attr-encrypted/attr_encrypted

answered Sep 7, 2016 at 21:16

Ram on Rails

1213 bronze badges

Add a comment |

Stack Exchange Network

Simple ActiveRecord attributes encryption in Rails 5+

2 Answers 2

You must log in to answer this question.

Hot Network Questions

Simple ActiveRecord attributes encryption in Rails 5+

2 Answers 2

You must log in to answer this question.

Related

Hot Network Questions