title: Is it OK to generate session secret(or any other secret keys) and store it in host server?
body: <p>I'm testing Google OAuth2.0 on node.js + express and using express-session for managing session, and I came across that I need <strong>Secret Key</strong> for my session manager.</p>
  
  <p>So I did some research and found <a href="http://pmuellr.blogspot.kr/2014/09/keeping-secrets-secret.html" rel="nofollow">a post</a>, which has some nice suggestions. But it seems to require some workarounds, like setting secret key as environment variable or keeping it in configuration file.</p>
  
  <ul>
  <li>Using the former, I need to enter environment variables every time I redeploy sever.</li>
  <li>Using the latter exposes my secret key to SCM.</li>
  </ul>
  
  <p><strong>So I decided to generate random string and store it in the host file system.</strong> It seems to solve all the problems I introduced above, but I'm noob to web development so I'm not sure whether this is legit.</p>
  
  <p>Is there any cons or exploit to this method?</p>
  
  <p>Below is my <code>sessionSecret.js</code> file:</p>
  
  <pre><code>var crypto = require('crypto');
  var fs = require('fs');
  
  var filePath = '/home/ubuntu/results.txt';
  
  function readSecretKey() {
      return new Promise(function(resolve, reject) {
          fs.readFile(filePath, 'utf8', function(err, key) {
              if (err) {
                  reject(err);
              } else {
                  resolve(key);
              }
          });
      });
  }
  
  function writeSecretKey(key) {
      return new Promise(function(resolve, reject) {
          fs.writeFile(filePath, key, function(err) {
              if (err) {
                  reject(err);
              } else {
                  resolve(key);
              }
          }); 
      });
  }
  
  function generateRandomString() {
      return new Promise(function(resolve, reject) {
          crypto.randomBytes(48, function(err, buf) {
              if (err) {
                  reject(err);
              } else {
                  resolve(buf.toString('hex'));
              }
          })
      });
  }
  
  module.exports.getOrCreate = function() {
      return new Promise(function(resolve, reject) {
          readSecretKey()
              .then(function(key) {
                  console.log("Key exists: " + key);
                  resolve(key);
              }, function() {
                  console.log("Key does not exists. Generating...");
                  return generateRandomString();
              })
              .then(function(key) {
                  if (key) {
                      console.log("Key generated: " + key);
                      return writeSecretKey(key);
                  }
              }).then(function(key) {
                  if (key) {
                      resolve(key);
                  }
              }, function(err) {
                  reject(err);
              });
      });
  };
  </code></pre>