According to the instructions on the AES encrypt project page, I should create an encryption.key file.

Create a new 128 bit encryption key. A good way to do this is in the command line using openssl: openssl rand -base64 16 > encryption.key.

What is a secure place where I should store the encryption.key file?

  • 1
    We usually keep them in a controlled folder outside of the Drupal directory (document root). I imagine it's best practice but a quick Google search didn't find anything to back that assumption. – sareed Apr 21 '17 at 13:08
  • 1
    That module is unsupported and has a critical security flaw: drupal.org/node/2857028 – mpdonadio Apr 21 '17 at 17:17
  • @sareed Keeping any encryption key/token outside a web-readable folder is definitely best practice (also out of version control but that will probably be implied by the directory separation) – Clive Apr 21 '17 at 19:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy