WebAppConstantSecretKey.qhelp

<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
<qhelp>

  <overview>
    <p>
      Flask and Django require a Securely signed key for singing the session cookies. most of the time developers rely on load hardcoded secret keys from a config file or python code. this proves that the way of hardcoded secret can make problems when you forgot to change the constant secret keys.
    </p>
  </overview>
  <recommendation>
    <p>
      In Flask Consider using a secure random generator with <a href="https://docs.python.org/3/library/secrets.html#secrets.token_hex">Python standard secrets library</a> 
    </p>
    <p>
      In Django Consider using a secure random generator with "get_random_secret_key()"" method from "django.core.management.utils".
    </p>
  </recommendation>
  <example>
    <p>Safe Django SECRET_KEY</p>
    <sample src="examples/example_Django_safe.py" />
    <p>Unsafe Django SECRET_KEY Example:</p>
    <sample src="examples/example_Django_unsafe.py" />
    <p>Safe Flask SECRET_KEY Example:</p>
    <sample src="examples/example_Flask_safe.py" />
    <sample src="examples/example_Flask_unsafe.py" />
    <p>Unsafe Flask SECRET_KEY Example:</p>
    <sample src="examples/example_Flask_unsafe2.py" />
    <p>config1.py</p>
    <sample src="examples/config1.py" />
    <p>config2.py</p>
    <sample src="examples/config2.py" />
    <p>config3.py</p>
    <sample src="examples/config3.py" />
    <p>__init__.py</p>
    <sample src="examples/settings/__init__.py" />
  </example>
  <references>
    <li>
      <a href="https://flask.palletsprojects.com/en/2.3.x/config/#SECRET_KEY">Flask Documentation</a>
    </li>
    <li>
      <a href="https://docs.djangoproject.com/en/4.2/ref/settings/#secret-key">Django Documentation</a>
    </li>
    <li>
      <a href="https://flask-jwt-extended.readthedocs.io/en/stable/basic_usage.html#basic-usage">Flask-JWT-Extended Documentation</a>
    </li>
    <li>
      <a href="https://www.horizon3.ai/cve-2023-27524-insecure-default-configuration-in-apache-superset-leads-to-remote-code-execution/">CVE-2023-27524 - Apache Superset had multiple CVEs related to this kind of Vulnerability</a>
    </li>
    <li>
      <a href="https://nvd.nist.gov/vuln/detail/CVE-2020-17526">CVE-2020-17526 - Apache Airflow had multiple CVEs related to this kind of Vulnerability</a>
    </li>
    <li>
      <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-41192">CVE-2021-41192 - Redash was assigning a environment variable with a default value which it was assigning the default secrect if the environment variable does not exists</a>
    </li>

  </references>
</qhelp>