如何为PlayFramework项目生成应用密钥？playGenerateSecret命令运行位置咨询

Hey there! Let's break down how to generate that critical application secret for your Play project, plus clarify exactly where to run the playGenerateSecret command.

Where to Run playGenerateSecret #

This is an sbt command provided by the Play Framework plugin, so you need to run it from the root directory of your Play project—that's the folder holding your build.sbt file and the project subfolder. You have two straightforward options:

• Using the interactive sbt shell:

  1. Open your terminal, navigate to your project root (e.g., cd ~/my-play-app)
  2. Run sbt to launch the sbt shell
  3. Once inside, type playGenerateSecret and hit enter

• Direct one-liner execution:
  Run this command directly from your project root in the terminal:

  sbt playGenerateSecret
  

What to Do After Running the Command #

When you execute playGenerateSecret, it will output a long, random string (like aBc123DeFgHiJkLmNoPqRsTuVwXyZ!@#$%^&*). This is your new application secret—here's how to integrate it:

1. Open your conf/application.conf file
2. Locate the secret configuration line:
   • For Play 2.6+ (including Play 3.x), it’s play.http.secret.key
   • Older Play versions use application.secret
3. Replace the existing value (or uncomment the line if it’s commented out) with your generated secret:

   play.http.secret.key = "your-generated-secret-string-here"
   

Security Best Practice #

Instead of hardcoding the secret into application.conf (never commit this to version control!), set it via an environment variable for safer deployment:

• Linux/macOS:

  PLAY_HTTP_SECRET_KEY="your-generated-secret" sbt run
  

• Windows (PowerShell):

  $env:PLAY_HTTP_SECRET_KEY="your-generated-secret"; sbt run
  

Alternative: Generate a Secret Manually #

If you can’t use playGenerateSecret for any reason, create a valid secret with these terminal commands:

• Linux/macOS:

  openssl rand -hex 32
  

• Windows (PowerShell):

  [System.Web.Security.Membership]::GeneratePassword(64, 10)
  

Ensure the string is at least 32 characters long for proper security.

内容的提问来源于stack exchange，提问作者Mehdi Amiri