mozilla-services/mozservices — pull request #12 by rfk (2012-03-30 04:26:20+00:00)
Title: Warn instead of failing when no token secret is configured.

This is a tweak to @ametaireau commit fb847e64.

When the MACAuthPlugin has secret=None and secret_file=None, it falls back to generating a random secret via os.urandom(). This is useful for getting started with a single-process deployment and for testing purposes.

So, rather than fail out in this case, I propose just logging a warning that the user should configure a secret via one of the supported mechanisms. I think it's more user-friendly than demanding that one be provided in the config before you can run anything, and safer than providing a default config secret which people might forget to override.

Alexis, thoughts?