ninja-core/src/main/java/ninja/utils/NinjaPropertiesImplTool.java
public static void checkThatApplicationSecretIsSet(
                                                boolean isProd,
                                                String baseDirWithoutTrailingSlash,                                                
                                                PropertiesConfiguration defaultConfiguration,
                                                Configuration compositeConfiguration) {
        
        String applicationSecret = compositeConfiguration.getString(NinjaConstant.applicationSecret);
        
        if (applicationSecret == null
                || applicationSecret.isEmpty()) {
            
            // If in production we stop the startup process. It simply does not make
            // sense to run in production if the secret is not set.
            if (isProd) {
                String errorMessage = "Fatal error. Key application.secret not set. Please fix that.";
                logger.error(errorMessage);
                throw new RuntimeException(errorMessage);
            }
            
            
            logger.info("Key application.secret not set. Generating new one and setting in conf/application.conf.");
            
            // generate new secret
            String secret = SecretGenerator.generateSecret();
            
            // set in overall composite configuration => this enables this instance to 
            // start immediately. Otherwise we would have another build cycle.
            compositeConfiguration.setProperty(NinjaConstant.applicationSecret, secret);
            
            // defaultConfiguration is: conf/application.conf (not prefixed)
            defaultConfiguration.setProperty(NinjaConstant.applicationSecret, secret);
            
            try {
                
                // STEP 1: Save in source directories:
                // save to compiled version => in src/main/target/
                String pathToApplicationConfInSrcDir = baseDirWithoutTrailingSlash + File.separator + "src" + File.separator + "main" + File.separator + "java" + File.separator + NinjaProperties.CONF_FILE_LOCATION_BY_CONVENTION;
                Files.createParentDirs(new File(pathToApplicationConfInSrcDir));
                // save to source
                defaultConfiguration.save(pathToApplicationConfInSrcDir);

                // STEP 2: Save in classes dir (target/classes or similar).
                // save in target directory (compiled version aka war aka classes dir)
                defaultConfiguration.save();
                
            } catch (ConfigurationException e) {
                logger.error("Error while saving new secret to application.conf.", e);
            } catch (IOException e) {
                logger.error("Error while saving new secret to application.conf.", e);
            } 
            
        }
        
    }
public static void checkThatApplicationSecretIsSet(
                                                boolean isProd,
                                                String baseDirWithoutTrailingSlash,                                                
                                                PropertiesConfiguration defaultConfiguration,
                                                Configuration compositeConfiguration) {
        
        String applicationSecret = compositeConfiguration.getString(NinjaConstant.applicationSecret);
        
        if (applicationSecret == null
                || applicationSecret.isEmpty()) {
            
            // If in production we stop the startup process. It simply does not make
            // sense to run in production if the secret is not set.
            if (isProd) {
                String errorMessage = "Fatal error. Key application.secret not set. Please fix that.";
                logger.error(errorMessage);
                throw new RuntimeException(errorMessage);
            }
            
            
            logger.info("Key application.secret not set. Generating new one and setting in conf/application.conf.");
            
            // generate new secret
            String secret = SecretGenerator.generateSecret();
            
            // set in overall composite configuration => this enables this instance to 
            // start immediately. Otherwise we would have another build cycle.
            compositeConfiguration.setProperty(NinjaConstant.applicationSecret, secret);
            
            // defaultConfiguration is: conf/application.conf (not prefixed)
            defaultConfiguration.setProperty(NinjaConstant.applicationSecret, secret);
            
            try {
                
                // STEP 1: Save in source directories:
                // save to compiled version => in src/main/target/
                String pathToApplicationConfInSrcDir = baseDirWithoutTrailingSlash + File.separator + "src" + File.separator + "main" + File.separator + "java" + File.separator + NinjaProperties.CONF_FILE_LOCATION_BY_CONVENTION;
                Files.createParentDirs(new File(pathToApplicationConfInSrcDir));
                // save to source
                defaultConfiguration.save(pathToApplicationConfInSrcDir);

                // STEP 2: Save in classes dir (target/classes or similar).
                // save in target directory (compiled version aka war aka classes dir)
                defaultConfiguration.save();
                
            } catch (ConfigurationException e) {
                logger.error("Error while saving new secret to application.conf.", e);
            } catch (IOException e) {
                logger.error("Error while saving new secret to application.conf.", e);
            } 
            
        }
        
    }
This method checks that your configurations have set a
application.secret=23r213r12r123

If application.secret is missing or is empty it will do the following:
- In dev and test mode it'll generate a new application secret and write the secret
to both src/main/java/conf/application.conf and the classes dir were the compiled stuff
goes.
- In prod it will throw a runtime exception and stop the server.