Update docs and samples to use CSRF_KEY and SESSION_AUTHENTICATION_KEY

README.md

@@ -45,11 +45,23 @@ In each space that you plan on deploying, you need to create a `user-provided-se
 Run:
 
 ```bash
-# For applications without New Relic monitoring
-cf cups dashboard-ups -p '{"CONSOLE_CLIENT_ID":"your-client-id","CONSOLE_CLIENT_SECRET":"your-client-secret", "SESSION_KEY": "a-really-long-secure-value", "SMTP_HOST": "smtp.host.com", "SMTP_PORT": "25", "SMTP_USER": "username", "SMTP_PASS": "password", "SMTP_FROM": "[email protected]"}'
-
-# For applications with New Relic monitoring
-cf cups dashboard-ups -p '{"CONSOLE_CLIENT_ID":"your-client-id","CONSOLE_CLIENT_SECRET":"your-client-secret","CONSOLE_NEW_RELIC_LICENSE":"your-new-relic-license", "SESSION_KEY": "a-really-long-secure-value", "SMTP_HOST": "smtp.host.com", "SMTP_PORT": "25", "SMTP_USER": "username", "SMTP_PASS": "password", "SMTP_FROM": "[email protected]"}'
+# Create user provided service with config
+# See https://github.com/18F/cg-dashboard/blob/master/helpers/env_vars.go for all env variables
+cf create-user-provided-service dashboard-ups -p @<(cat <<EOF
+{
+  "CONSOLE_CLIENT_ID": "your-client-id",
+  "CONSOLE_CLIENT_SECRET": "your-client-secret",
+  "CSRF_KEY": "$(openssl rand -hex 32)",
+  "SESSION_AUTHENTICATION_KEY": "$(openssl rand -hex 64)",
+  "SMTP_HOST": "smtp.host.com",
+  "SMTP_PORT": "25",
+  "SMTP_USER": "username",
+  "SMTP_PASS": "password",
+  "SMTP_FROM": "[email protected]",
+  "CONSOLE_NEW_RELIC_LICENSE": ""
+}
+EOF
+)
 ```
 
 Create a redis service instance:

docker-compose.yml

@@ -31,7 +31,8 @@ services:
             "credentials": {
                "CONSOLE_CLIENT_ID": "dashboard-local",
                "CONSOLE_CLIENT_SECRET": "notarealsecret",
-               "SESSION_KEY": "notarealsessionkey",
+               "CSRF_KEY": "notarealcsrfkey",
+               "SESSION_AUTHENTICATION_KEY": "notarealsessionauthenticationkey",
                "SMTP_FROM": "[email protected]",
                "SMTP_HOST": "smtp.fake.com",
                "SMTP_PASS": "",

env.sample

@@ -24,7 +24,10 @@ export CONSOLE_API_URL=https://api.fr.cloud.gov
 export CONSOLE_LOG_URL=https://loggregator.fr.cloud.gov
 
 # The key used to protect session data
-export SESSION_KEY=GONMwryeLTC7a3sRjjDi
+export CSRF_KEY="$(openssl rand -hex 32)"
+
+# The key used to protect session data
+export SESSION_AUTHENTICATION_KEY="$(openssl rand -hex 64)"
 
 # <optional> If set to `true` or `1`, will turn on `/debug/pprof` endpoints as seen [here](https://golang.org/pkg/net/http/pprof/)
 # export PPROF_ENABLED=true