#24994: Document/check that settings.SECRET_KEY should be a valid unicode string
-------------------------------------+-------------------------------------
Reporter: Baptiste Mispelon | Owner: MaartenPI
Type: | Status: closed
Cleanup/optimization |
Component: Core (System | Version: 1.8
checks) |
Severity: Normal | Resolution: needsinfo
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 1
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Changes (by Tim Graham):
* status: assigned => closed
* resolution: => needsinfo
Comment:
from mejiaa on the pull request:
What are those cryptic errors that occur when using bytes? I saw no links
to issues pertaining to these cryptic messages.\\ \\
Also, I'm not sure of this but there seems to be a belief that keys
should be unicode characters and truly random bytes as keys are strange
and/or not used in practice. Using truly random byte strings (bytes with
values 0 - 255) as keys is not strange at all. In fact, it is recommended
practice. See also https://tools.ietf.org/html/rfc4086. \\ \\
I'm not seeing a compelling argument for ensuring the secret key is a
valid unicode string. At worst, you'll be adding an extra burden on your
users to base64 encode their secret keys or do some other transformation
in order to continue using Django. As it stands, this change does not make
it clear what issues are being resolved, offers no enhanced security,
implies to users that they go against recommended practice for generating
cryptographic keys, and adds an unnecessary burden on your users to
generate a proper cryptographic key. I would prefer if this restriction is
not accepted and users like myself can continue to use random byte strings
as secret keys, with the consideration that it seems this change offers no
benefit.
Given the lack of details here, I think it's best to close the ticket
until a more compelling case for this check can be offered.
--
Ticket URL: <https://code.djangoproject.com/ticket/24994#comment:12>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/067.b831b2eb6f7245d04fe67625719fb4b0%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
