diff options
| author | Erik Romijn <eromijn@solidlinks.nl> | 2013-05-18 16:35:39 +0200 |
|---|---|---|
| committer | Aymeric Augustin <aymeric.augustin@m4x.org> | 2013-05-18 16:53:13 +0200 |
| commit | d5ce2ff5e485bf94fcade340bc803ba4671bd95a (patch) | |
| tree | 332a056f6282b1890b0796e1d14a0e0be9d01888 /docs/topics/http | |
| parent | 3634948c883c89a9dbf303b9687331a2a5db43ce (diff) | |
Fixed #20444 -- Cookie-based sessions does not include a remote code execution-warning
Diffstat (limited to 'docs/topics/http')
| -rw-r--r-- | docs/topics/http/sessions.txt | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/docs/topics/http/sessions.txt b/docs/topics/http/sessions.txt index acad61eb2a..0f2955fadd 100644 --- a/docs/topics/http/sessions.txt +++ b/docs/topics/http/sessions.txt @@ -125,6 +125,17 @@ and the :setting:`SECRET_KEY` setting. .. warning:: + **If the :setting:`SECRET_KEY` is not kept secret, this can lead to + arbitrary remote code execution.** + + An attacker in possession of the :setting:`SECRET_KEY` can not only + generate falsified session data, which your site will trust, but also + remotely execute arbitrary code, as the data is serialized using pickle. + + If you use cookie-based sessions, pay extra care that your secret key is + always kept completely secret, for any system which might be remotely + accessible. + **The session data is signed but not encrypted** When using the cookies backend the session data can be read by the client. |