Django Secret Key Compromised

Question

I am wondering what are the steps one would need to take should the production secret key become compromised. Luckily, that is not the case, but it would be good to know, nonetheless.

In particular, what happens if one simply swaps the old key to a newly generated one? Since it is used in making hashes, does it break the entire system or make it unstable?

In the case of a compromise, would the response be as simple as generating a new key and inserting it into the production settings?

Answer 1

The SECRET_KEY is used for the following:

• All sessions if you are using any other session backend than django.contrib.sessions.backends.cache, or are using the default get_session_auth_hash().
• All messages if you are using CookieStorage or FallbackStorage.
• All PasswordResetView tokens.
• Any usage of cryptographic signing, unless a different key is provided.

"If you rotate your secret key, all of the above will be invalidated. Secret keys are not used for passwords of users and key rotation will not affect them."

You can use the following function to generate a new key:

from django.core.management.utils import get_random_secret_key

print(get_random_secret_key())

Simply copy/paste the printed results into your settings.py.