I am wondering, why in cake php framework, they include default values for this variable:

  • salt
  • cipher seed

I found these default values while doing application review (white box approach). And I found out that the developer didn't modify these values.

CMIIW, if the developers didn't modify these values, it is more prone to brute force attack by providing these default value.


This definitely looks like a very bad practice.

A quick search on github brings up ~11,000 projects where the same default cakephp salt has been used.
Cakephp shows a notice when the value haven't been changed:

Please change the value of 'Security.salt' in app/config/core.php to a 
salt value specific to your application [CORE/cake/libs/debugger.php, line 848] 

So one potential reason for having a default salt and seed is the ability to detect if the user is using the default, unchanged and insecure salt and be able to helpfully instruct him to change it.

Refer this function where it makes sure you are not using the default values. Unlike other frameworks like Rails where the secret_token is generated on the fly when you create a new rails project, cakephp basically has a unzip and start using it approach where generating a salt on the fly is not easy.

However, the same code that checks that the values are not default can also potentially create a random salt and replace the values in the conf files when it sees default values being used. This would happen only once - ideally the first time ever a cakephp app is run - and then the values are changed forever.

Also when default values are used, it should be raise an Error (instead of a subtle notice which can be ignored) which won't let you deploy/run cakephp unless you change these values.

Obviously the advantages of seed and salt are lost if everyone uses the same known values. Hopefully someone from the cakephp team shares your concern and changes this default behavior.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.