mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-30 17:16:10 +00:00
Code Issues 32 Releases Wiki Activity

[1.5.x] Fixed #20444 -- Cookie-based sessions does not include a remote code execution-warning

Browse Source 
Backport of d5ce2ff5e4 from master
This commit is contained in:
Erik Romijn
2013-05-18 16:35:39 +02:00
committed by Tim Graham
parent cb2fee567f
commit 2b750fff56
1 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
docs/topics/http/sessions.txt
View File

@@ -124,6 +124,17 @@ and the :setting:`SECRET_KEY` setting.
.. warning::
**If the :setting:`SECRET_KEY` is not kept secret, this can lead to
arbitrary remote code execution.**
An attacker in possession of the :setting:`SECRET_KEY` can not only
generate falsified session data, which your site will trust, but also
remotely execute arbitrary code, as the data is serialized using pickle.
If you use cookie-based sessions, pay extra care that your secret key is
always kept completely secret, for any system which might be remotely
accessible.
**The session data is signed but not encrypted**
When using the cookies backend the session data can be read by the client.