From 4ad57bbe31bc1813264824111de2f9f74dbda0d6 Mon Sep 17 00:00:00 2001 From: Erik Romijn Date: Sat, 20 Sep 2014 10:05:03 +0200 Subject: [PATCH] Fixed #22310 -- Documented exact usage of SECRET_KEY Thanks to Tim Graham for the review. --- docs/ref/settings.txt | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/docs/ref/settings.txt b/docs/ref/settings.txt index 6f2cfefb4b8..87536aca97f 100644 --- a/docs/ref/settings.txt +++ b/docs/ref/settings.txt @@ -2004,6 +2004,29 @@ Django will refuse to start if :setting:`SECRET_KEY` is not set. security protections, and can lead to privilege escalation and remote code execution vulnerabilities. +The secret key is used for: + +* All :doc:`sessions ` if you are using + any other session backend than ``"django.contrib.sessions.backends.cache"``, + or if you use + :class:`~django.contrib.auth.middleware.SessionAuthenticationMiddleware` + and are using the default + :meth:`~django.contrib.auth.models.AbstractBaseUser.get_session_auth_hash()`. +* All :doc:`messages ` if you are using + :class:`~django.contrib.messages.storage.cookie.CookieStorage` or + :class:`~django.contrib.messages.storage.fallback.FallbackStorage`. +* :doc:`Form wizard ` progress when using + cookie storage with + :class:`django.contrib.formtools.wizard.views.CookieWizardView`. +* All :func:`~django.contrib.auth.views.password_reset` tokens. +* All in progress :doc:`form previews `. +* Any usage of :doc:`cryptographic signing `, unless a + different key is provided. + +If you rotate your secret key, all of the above will be invalidated. +Secret keys are not used for passwords of users and key rotation will not +affect them. + .. setting:: SECURE_BROWSER_XSS_FILTER SECURE_BROWSER_XSS_FILTER