Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse files

Fixed #18759 -- updated SECRET_KEY documentation

  Document SECRET_KEY becoming required in 1.5.

  Also expand the description slightly, and add a more prominent warning
  about the security implications of running with an exposed SECRET_KEY.
  • Loading branch information...
commit e38112d882a8aec0aaf6d52ab6d07fa1a408a3aa 1 parent fd04e71
@pjdelport pjdelport authored DrMeers committed
Showing with 17 additions and 3 deletions.
  1. +17 −3 docs/ref/settings.txt
View
20 docs/ref/settings.txt
@@ -1537,9 +1537,23 @@ SECRET_KEY
Default: ``''`` (Empty string)
-A secret key for this particular Django installation. Used to provide a seed in
-secret-key hashing algorithms. Set this to a random string -- the longer, the
-better. ``django-admin.py startproject`` creates one automatically.
+A secret key for a particular Django installation. This is used to provide
+:doc:`cryptographic signing </topics/signing>`, and should be set to a unique,
+unpredictable value.
+
+:djadmin:`django-admin.py startproject <startproject>` automatically adds a
+randomly-generated ``SECRET_KEY`` to each new project.
+
+.. warning::
+
+ **Keep this value secret.**
+
+ Running Django with a known :setting:`SECRET_KEY` defeats many of Django's
+ security protections, and can lead to privilege escalation and remote code
+ execution vulnerabilities.
+
+.. versionchanged:: 1.5
+ Django will now refuse to start if :setting:`SECRET_KEY` is not set.
.. setting:: SECURE_PROXY_SSL_HEADER
Please sign in to comment.
Something went wrong with that request. Please try again.