test0908
/
django
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[1.7.x] Fixed #22310 -- Documented exact usage of SECRET_KEY 

Backport of 4ad57bbe31 from master.
This commit is contained in:
Erik Romijn 2014-10-04 09:25:11 +02:00
parent adae224572
commit ab8afafcc0
1 changed files with 23 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
docs/ref/settings.txt
View File

@ -1899,6 +1899,29 @@ Django will refuse to start if :setting:`SECRET_KEY` is not set.
security protections, and can lead to privilege escalation and remote code
execution vulnerabilities.
The secret key is used for:
* All :doc:`sessions </topics/http/sessions>` if you are using
any other session backend than ``"django.contrib.sessions.backends.cache"``,
or if you use
:class:`~django.contrib.auth.middleware.SessionAuthenticationMiddleware`
and are using the default
:meth:`~django.contrib.auth.models.AbstractBaseUser.get_session_auth_hash()`.
* All :doc:`messages </ref/contrib/messages>` if you are using
:class:`~django.contrib.messages.storage.cookie.CookieStorage` or
:class:`~django.contrib.messages.storage.fallback.FallbackStorage`.
* :doc:`Form wizard </ref/contrib/formtools/form-wizard>` progress when using
cookie storage with
:class:`django.contrib.formtools.wizard.views.CookieWizardView`.
* All :func:`~django.contrib.auth.views.password_reset` tokens.
* All in progress :doc:`form previews </ref/contrib/formtools/form-preview>`.
* Any usage of :doc:`cryptographic signing </topics/signing>`, unless a
different key is provided.
If you rotate your secret key, all of the above will be invalidated.
Secret keys are not used for passwords of users and key rotation will not
affect them.
.. setting:: SECURE_PROXY_SSL_HEADER
SECURE_PROXY_SSL_HEADER