-
Notifications
You must be signed in to change notification settings - Fork 214
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Change Django secret key to make it more obvious it's a shim value #3422
Conversation
@@ -1,7 +1,7 @@ | |||
PYTHONUNBUFFERED=0 | |||
|
|||
DJANGO_SETTINGS_MODULE=conf.settings | |||
DJANGO_SECRET_KEY="ny#b__$$f6ry4wy8oxre97&-68u_0lk3gw(z=d40_dxey3zw0v1" | |||
DJANGO_SECRET_KEY=example_key |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Making it a reminder to change it would be nice too.
DJANGO_SECRET_KEY=example_key | |
DJANGO_SECRET_KEY=example_key_CHANGE_IT_IN_PRODUCTION |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We can also update settings.py
to raise an error if it's unchanged.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for the suggestion, and I like that idea @dhruvkb! I'll add an issue for it :)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM, with a suggestion for additional safety.
@@ -1,7 +1,7 @@ | |||
PYTHONUNBUFFERED=0 | |||
|
|||
DJANGO_SETTINGS_MODULE=conf.settings | |||
DJANGO_SECRET_KEY="ny#b__$$f6ry4wy8oxre97&-68u_0lk3gw(z=d40_dxey3zw0v1" | |||
DJANGO_SECRET_KEY=example_key |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We can also update settings.py
to raise an error if it's unchanged.
Description
This PR makes a quick change to the config for the local application to make it clear that the secret key which is used is not an erroneously exposed value used in live environments.
Testing Instructions
api/.env
file locally if you have onejust a
and check that the API is accessible & searchable at http://localhost:50270Checklist
Update index.md
).main
) or a parent feature branch.Developer Certificate of Origin
Developer Certificate of Origin