Effects of changing Django’s SECRET_KEY

by

Edit: This answer is based on django 1.5

SECRET_KEY is used in a lot of various places, I’ll point out what is impacted by it first and then try to go over that list and give precise explanation of the impact.

The list of things using SECRET_KEY directly or indirectly:

In reality a lot of the items listed here use SECRET_KEY through django.utils.crypt.get_random_string() which uses it to seed the random engine. This won’t be impacted by a change in value of SECRET_KEY.

User experience directly impacted by a change of value are:

  • sessions, the data decode will break, that is valid for any session backend (cookies, database, file based or cache).
  • password reset token already sent won’t work, users will have to ask a new one.
  • comments form (if using django.contrib.comments) will not validate if it was requested before the value change and submitted after the value change. I think this is very minor but might be confusing for the user.
  • messages (from django.contrib.messages) won’t validate server-side in the same timing conditions as for comments form.

UPDATE: now working on django 1.9.5, a quick look at the source gives me pretty much the same answers. Might do a thorough inspection later.

More Related Contents:

  1. (13: Permission denied) while connecting to upstream:[nginx]
  2. Django Cookies, how can I set them?
  3. Issue with ManyToMany Relationships not updating immediately after save
  4. How to revert the last migration?
  5. Get model’s fields in Django
  6. Can django’s auth_user.username be varchar(75)? How could that be done?
  7. Custom QuerySet and Manager without breaking DRY?
  8. Django: Query using contains each value in a list
  9. Changing Django settings at runtime
  10. How do you serialize a model instance in Django?
  11. How to get the list of the authenticated users?
  12. How to make email field unique in model User from contrib.auth in Django
  13. creating my own context processor in django
  14. Get list item dynamically in django templates
  15. Workflow frameworks for Django [closed]
  16. Select DISTINCT individual columns in django?
  17. Django ModelForm override widget
  18. Django Push HTTP Response to users [closed]
  19. Django – Cascade deletion in ManyToManyRelation
  20. CSRF with Django, React+Redux using Axios
  21. django unit tests without a db
  22. ImportError: No module named ‘_sqlite3’ in python3.3
  23. Django: permission denied when trying to access database after restore (migration)
  24. Django REST Framework image upload
  25. How to iterate over nested dictionaries in django templates
  26. Docker-compose with django could not translate host name “db” to address: Name or service not known
  27. Django on Google App Engine
  28. Django static files on heroku
  29. Django: dynamic database file
  30. User groups and permissions

Leave a Comment