1

I use OpenID Connect to let my users login. What could happen if Flasks SECRET_KEY becomes public?

0

If the openid connect relies on flask's session manager, then the session cookies are predictable.

Flask uses the SECRET_KEY for session management, so if I know you SECRET_KEY, I can make a bogus session cookie and impersonate another user, even the admin user.

https://github.com/pallets/flask/blob/1351d0a56580df36872b466eb245e7634c20dab5/src/flask/sessions.py

This seems the only place SECRET_KEY is used in the source code. I went to github and searched for SECRET_KEY and this is the only code that uses it. The rest of the 15 references were docs, tests, or configuration files.

  • It didn't happen to me. The question was not what to do, but what an attacker can do with it. – Martin Thoma Aug 27 at 18:36
  • The "what can an attacker do with it" was in there, too. I removed the part about changing it now and added a github reference. – Jonathan Aug 27 at 18:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.