search

stefanzweifel / screeenly

📸 Screenshot as a Service
https://secure.screeenly.com
MIT License
492 stars 102 forks source link

Heroku APP_KEY generation instructions very unclear #367

Closed JonnyHaystack closed 2 years ago

JonnyHaystack commented 2 years ago

Describe the bug The wiki guide for setting up on Heroku says to run php artisan key:generate but doesn't give any instructions on how to set up the tools needed to do that. I managed to figure it out on my own but it was really not obvious. I hadn't heard of Laravel of artisan before so it was hard to even know what to search. I could see other people struggling with this a lot more than I did.

Also, that command is actually wrong. You have to run php artisan key:generate --show otherwise it won't output anything.

Expected behavior The step by step guide should have more detail for how to generate this application key.

Screenshots image

stefanzweifel commented 2 years ago

@JonnyHaystack Thanks for reporting! I've updated the wiki to use the --show option in that command: https://github.com/stefanzweifel/screeenly/wiki/Deploy-to-Heroku.

When I wrote that guide, I remember struggling on exactly this part of the documentation. People who want to deploy the app to Heroku don't necessarily have any knowledge or experience with PHP or Laravel and might run into issues when wanting to run php artisan key:generate --show. That's why I have added an example value to the wiki, so people could just copy and paste that. IMHO the vulnerability risk is quite small, as people probably don't share their Heroku instance with the world and don't store sensitive information in the app itself.

But I just had an idea on how to solve this problem in the long run by making a website that just generates and displays Laravel application keys for you. Will work on that over the next couple of days.

I could see other people struggling with this a lot more than I did.

Yeah, it's not ideal. I'm happy about any feedback I get about this topic (you're the first so far). Sorry if this generated a headache or was complicated to setup for you.

Appreciate the input!

JonnyHaystack commented 2 years ago

Thanks! The changes look good. The main thing that caused me to waste time was I didn't realise until the end of the guide that I could just run the command in the heroku app, so I ended up having to figure out how to set up laravel locally to use artisan. Looks like you've made that clear now which is great :smile:

stefanzweifel commented 2 years ago

I've updated the guide again. I've now deployed a separate app that just generates new encryption keys on every page request. You and others can now just head to the website and grab a key from there. No need to manually invoke the commands anymore.

→ https://laravel-encryption-key-generator.vercel.app/