mirrors/django
mirrors/django
0
0
Fork 0
mirror of https://github.com/django/django.git synced 2024-12-01 15:42:04 +01:00
Code Issues Releases Wiki Activity

Fixed #18759 -- updated SECRET_KEY documentation

Browse Source 
Document SECRET_KEY becoming required in 1.5.

  Also expand the description slightly, and add a more prominent warning
  about the security implications of running with an exposed SECRET_KEY.
This commit is contained in:
Piet Delport 2012-08-13 14:10:40 +02:00 committed by Simon Meers
parent fd04e711d2
commit e38112d882
1 changed files with 17 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
docs/ref/settings.txt
View File

@ -1537,9 +1537,23 @@ SECRET_KEY
Default: ``''`` (Empty string)
A secret key for this particular Django installation. Used to provide a seed in
secret-key hashing algorithms. Set this to a random string -- the longer, the
better. ``django-admin.py startproject`` creates one automatically.
A secret key for a particular Django installation. This is used to provide
:doc:`cryptographic signing </topics/signing>`, and should be set to a unique,
unpredictable value.
:djadmin:`django-admin.py startproject <startproject>` automatically adds a
randomly-generated ``SECRET_KEY`` to each new project.
.. warning::
**Keep this value secret.**
Running Django with a known :setting:`SECRET_KEY` defeats many of Django's
security protections, and can lead to privilege escalation and remote code
execution vulnerabilities.
.. versionchanged:: 1.5
Django will now refuse to start if :setting:`SECRET_KEY` is not set.
.. setting:: SECURE_PROXY_SSL_HEADER