I use OpenID Connect to let my users login. What could happen if Flasks SECRET_KEY becomes public?

1 Answer 1


If the openid connect relies on flask's session manager, then the session cookies are predictable.

Flask uses the SECRET_KEY for session management, so if I know you SECRET_KEY, I can make a bogus session cookie and impersonate another user, even the admin user.


This seems the only place SECRET_KEY is used in the source code. I went to github and searched for SECRET_KEY and this is the only code that uses it. The rest of the 15 references were docs, tests, or configuration files.

  • It didn't happen to me. The question was not what to do, but what an attacker can do with it. Aug 27, 2019 at 18:36
  • The "what can an attacker do with it" was in there, too. I removed the part about changing it now and added a github reference.
    – Jonathan
    Aug 27, 2019 at 18:44
  • One way to minimise the risk of relying on this one key, is to keep changing it automatically. This would invalidate all the existing open ID connect tokens, but if you are using refresh tokens as well, then those can be then used to get new ID connect tokens signed with the new keys. Read more about it here. Nov 14, 2019 at 10:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .