Secret

What HttpApp.secret does by default: EnvVar when it is set, and a throwaway otherwise, so that hello runs with no configuration. Under the sbt plugin's dev loop EnvVar is always set, because the plugin generates one secret per sbt session and hands it to every restart, so sessions survive an edit; the throwaway is what a run outside that loop gets. It is announced once, at WARNING, because it is the right default for trying an application and the wrong one for a deployment: every session ends with the process, and two instances cannot read each other's cookies.

A secret from configured text, its UTF-8 bytes as the key. Fewer than 32 bytes is refused, empty text included: HMAC would accept any of them, but a short key can be guessed, and a guessed key signs a session anyone can forge. Bytes, not characters, because the bytes are the key.

A throwaway: 32 bytes from SecureRandom, which reads /dev/urandom and never blocks. Not getInstanceStrong, which can stall a boot on a fresh machine waiting for entropy.

The variable the default reads: EEZO_SECRET, beside EEZO_DB_URL.