What’s the purpose of Django setting ‘SECRET_KEY’?

by

It is used for making hashes. Look:

>grep -Inr SECRET_KEY *
conf/global_settings.py:255:SECRET_KEY = ''
conf/project_template/settings.py:61:SECRET_KEY = ''
contrib/auth/tokens.py:54:        hash = sha_constructor(settings.SECRET_KEY + unicode(user.id) +
contrib/comments/forms.py:86:        info = (content_type, object_pk, timestamp, settings.SECRET_KEY)
contrib/formtools/utils.py:15:    order, pickles the result with the SECRET_KEY setting, then takes an md5
contrib/formtools/utils.py:32:    data.append(settings.SECRET_KEY)
contrib/messages/storage/cookie.py:112:        SECRET_KEY, modified to make it unique for the present purpose.
contrib/messages/storage/cookie.py:114:        key = 'django.contrib.messages' + settings.SECRET_KEY
contrib/sessions/backends/base.py:89:        pickled_md5 = md5_constructor(pickled + settings.SECRET_KEY).hexdigest()
contrib/sessions/backends/base.py:95:        if md5_constructor(pickled + settings.SECRET_KEY).hexdigest() != tamper_check:
contrib/sessions/backends/base.py:134:        # Use settings.SECRET_KEY as added salt.
contrib/sessions/backends/base.py:143:                       settings.SECRET_KEY)).hexdigest()
contrib/sessions/models.py:16:        pickled_md5 = md5_constructor(pickled + settings.SECRET_KEY).hexdigest()
contrib/sessions/models.py:59:        if md5_constructor(pickled + settings.SECRET_KEY).hexdigest() != tamper_check:
core/management/commands/startproject.py:32:        # Create a random SECRET_KEY hash, and put it in the main settings.
core/management/commands/startproject.py:37:        settings_contents = re.sub(r"(?<=SECRET_KEY = ')'", secret_key + "'", settings_contents)
middleware/csrf.py:38:                % (randrange(0, _MAX_CSRF_KEY), settings.SECRET_KEY)).hexdigest()
middleware/csrf.py:41:    return md5_constructor(settings.SECRET_KEY + session_id).hexdigest()

More Related Contents:

  1. I need to securely store a username and password in Python, what are my options? [closed]
  2. Encrypted and secure docker containers
  3. Do CSRF attacks apply to API’s?
  4. Pillow installed, but getting “no module named pillow”
  5. How to query as GROUP BY in django?
  6. How do I filter query objects by date range in Django?
  7. Does Django scale? [closed]
  8. In Django, how does one filter a QuerySet with dynamic field lookups?
  9. How to redirect with post data (Django)
  10. ImportError: No module named ‘django.core.urlresolvers’
  11. How does Django Know the Order to Render Form Fields?
  12. Django server killed frequently
  13. Django Server Error: port is already in use
  14. Is this the way to validate Django model fields?
  15. Django: signal when user logs in?
  16. How do you join two tables on a foreign key field using django ORM?
  17. Django: Get an object form the DB, or ‘None’ if nothing matches
  18. How to create virtual env with python3
  19. How to have a Python script for a Django app that accesses models without using the manage.py shell?
  20. Can one use the Django database layer outside of Django?
  21. You are trying to add a non-nullable field ‘new_field’ to userprofile without a default
  22. How to monkey patch Django?
  23. sqlite3.OperationalError: unable to open database file
  24. The view didn’t return an HttpResponse object. It returned None instead
  25. How to get the previous URL from a POST in Django
  26. FullCalendar in Django
  27. Resize fields in Django Admin
  28. Django: sudden DB reset after Heroku sleep
  29. “gettext()” vs “gettext_lazy()” in Django
  30. “Failed building wheel for psycopg2” – MacOSX using virtualenv and pip

Leave a Comment