1

I've been hunting through questions here, Discord, Craft docs for solutions for a boilerplate Craft CMS install. Because I want to include section & field configurations, I'm planning on importing an export of the boilerplate database into a new database for the project.

It's documented in a few places that you can run craft setup/security-key (or craft setup/app-id) to generate a new key and store it in .env, but nothing says how that impacts a database that's already established. They all seem to assume you'd run that step before creating the database.

If you clone a project & existing database that's already used that first project's security key, and you want to have a unique security key for the new project, are you breaking the ability to decrypt data that was in the initial project when you generate a new security key? I don't see any indication that Craft updates the database when you generate a new key. It just updates .env.

Improve this question
2
  • This answer from Brad might be with a read? TLDR: unless you're encrypting data yourself in the database, you should be okay.
    – RitterKnight
    Commented Jan 26, 2021 at 17:02
  • @RitterKnight Thanks for the reply! I did read that, but it doesn't seem definitive. I believe the conclusion was "we can't stop plugin developers from encrypting data and we can't promise we won't in the future." As I'm looking to create something I'll be using into the future, I'd like to know it's on solid footing.
    – Mark J. Reeves
    Commented Jan 26, 2021 at 21:06

1 Answer 1

Reset to default
0

Not sure there is a definitive answer here. :) For the use-case you're concerned about, Craft uses the security key to encrypt/decrypt data in the database. In a stock Craft installation, that's for sensitive email settings.

Even then, with the advent of Project Config, that's not likely an issue anymore. Those settings will get stored in Project Config files, which hopefully are using environment variables to hide their values.

I'd guess that 99% of plugins aren't encrypting/decrypting sensitive info and the ones that are, are probably storing that info in Project Config, so it still wouldn't be a concern.

Improve this answer
1
  • So as long as I'm using project config, the original project's security key is never actually in play, and generating a new key for each subsequent project is safely establishing that new key for future possible use. Thanks!
    – Mark J. Reeves
    Commented Jan 27, 2021 at 13:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.