I am nearing a point where I will deploy my Django application to the hostile environment otherwise known as "the internet" and I'm trying to better understand the ramifications of the Django
SECRET_KEY. One of the standard procedures it seems is to secure the secret key in the
settings.py. Fair enough. The docs go so far to say to not commit your secret key to SVN, CVS, etc... For this provides easy access to your key. However, if anyone were tempted to commit the secret key to their repo, this would indicate that the secret key is static (see question #4)?
Anyway, here are my questions:
- How is storing the secret key as an environment variable any more secure than storing it directly in
settings.py? For example, if an attacker can read
settings.py, he more than likely can just type
$ echo $DJANGO_SECRET_KEY!
- How is storing the secret key in a file any more secure than storing it directly in
settings.py? If he can read
settings.py, he probably can read
- If the attacker has compromised your machine, can't they simply load the python interpreter with
> print settings.SECRET_KEY?
- Finally, would it be a bad practice to randomly generate the secret key each time the webserver process is restarted? This could be completely random, or it could prompt for user input for the key. Obviously, the latter presents a serious weakness if the attacker himself can restart the webservice and input the key of his choice.