From 3328078a01f5268f9b8659f56fd28c5a2ed083dc Mon Sep 17 00:00:00 2001 From: Jacob Walls Date: Wed, 3 Jun 2026 09:23:37 -0400 Subject: Refs CVE-2026-6873 -- Defaulted SIGNED_COOKIE_LEGACY_SALT_FALLBACK transitional setting to False. --- docs/internals/deprecation.txt | 3 +++ docs/ref/settings.txt | 15 +++++++++++---- docs/releases/6.1.txt | 13 +++++++++++++ 3 files changed, 27 insertions(+), 4 deletions(-) (limited to 'docs') diff --git a/docs/internals/deprecation.txt b/docs/internals/deprecation.txt index 5a2aa5d5b8..4b586fef29 100644 --- a/docs/internals/deprecation.txt +++ b/docs/internals/deprecation.txt @@ -36,6 +36,9 @@ details on these changes. * The ``URLIZE_ASSUME_HTTPS`` transitional setting will be removed. +* The ``SIGNED_COOKIE_LEGACY_SALT_FALLBACK`` transitional setting will be + removed. + * Using a percent sign in a column alias or annotation will raise ``ValueError``. diff --git a/docs/ref/settings.txt b/docs/ref/settings.txt index b69cafad5a..31762338b9 100644 --- a/docs/ref/settings.txt +++ b/docs/ref/settings.txt @@ -2838,16 +2838,23 @@ See also :setting:`DATE_FORMAT` and :setting:`SHORT_DATE_FORMAT`. .. versionadded:: 5.2.15 -Default: ``True`` +Default: ``False`` Controls whether :meth:`~django.http.HttpRequest.get_signed_cookie` accepts cookies signed with Django's historical signed-cookie salt derivation based on ``key + salt``. -Set this to ``False`` to reject those legacy signed cookies and only accept +Set this to ``True`` to accept those legacy signed cookies in addition to cookies signed with Django's current unambiguous signed-cookie salt derivation. -This transitional setting will be removed in Django 7.0, when the legacy signed -cookies will no longer be accepted. + +.. versionchanged:: 6.1 + + In older versions, the default was ``True``. + +.. deprecated:: 6.1 + + This transitional setting will be removed in Django 7.0, when legacy signed + cookies will no longer be accepted. .. setting:: SIGNING_BACKEND diff --git a/docs/releases/6.1.txt b/docs/releases/6.1.txt index f9fb779ff3..7ef149f40c 100644 --- a/docs/releases/6.1.txt +++ b/docs/releases/6.1.txt @@ -331,6 +331,13 @@ Requests and Responses the :func:`~django.shortcuts.redirect` shortcut, now accept a ``max_length`` parameter to override the default maximum URL length limit. +Security +~~~~~~~~ + +* Signed cookies now use an unambiguous salt derivation by default. Set + :setting:`SIGNED_COOKIE_LEGACY_SALT_FALLBACK` to ``True`` to continue + accepting legacy signed cookies. + Serialization ~~~~~~~~~~~~~ @@ -508,6 +515,9 @@ Miscellaneous * The minimum supported version of SQLite is increased from 3.31.0 to 3.37.0. +* The default value of the transitional setting + :setting:`SIGNED_COOKIE_LEGACY_SALT_FALLBACK` is now ``False``. + * :class:`~django.contrib.contenttypes.fields.GenericForeignKey` now uses a separate descriptor class: the private ``GenericForeignKeyDescriptor``. @@ -625,6 +635,9 @@ Miscellaneous * The :setting:`USE_BLANK_CHOICE_DASH` transitional setting is deprecated. +* The :setting:`SIGNED_COOKIE_LEGACY_SALT_FALLBACK` transitional setting is + deprecated. + * The undocumented ``get_placeholder`` method of :class:`~django.db.models.Field` is deprecated in favor of the newly introduced ``get_placeholder_sql`` method, which has the same input signature -- cgit v1.3