doismellburning/django12factor — pull request #1 by carlio (2013-05-08 07:03:05+00:00)
Title: Don't set SECRET_KEY if it is not set

Currently, if `SECRET_KEY` is not in the environment, django12factor will log a warning, generate a random value, and carry on.

The value of `SECRET_KEY` is used internally by Django for [cryptographic signing](https://docs.djangoproject.com/en/dev/topics/signing/) so its value is kind of sacred.

Using a value for `SECRET_KEY` which changes on every startup is a bad idea because it will render any existing signed data as invalid. This would be especially frustrating during development when the server reboots due to a code change, and the reason why things such as signed cookies no longer work would be non-obvious.

An alternative of generating the value statically (for example, `SECRET_KEY=socket.gethostname()` would alleviate that problem, but introduces potential security problems. For example, if an application is running production without the `SECRET_KEY` explicitly set, then it will be implicitly set. If an attacker can work out the parameters used to set the key (for example, the hostname), then they are easily able to sign data, which would enable them to create 'reset password' links for example.