[RFC][BC][FrameworkBundle] Force users to set "kernel.secret" to something unique #6598
Conversation
…ferent than default "ThisTokenIsNotSoSecretChangeIt"
This PR was merged into the master branch. Commits ------- f5290b9 [FrameworkBundle] Force users to set "kernel.secret" to something different than default "ThisTokenIsNotSoSecretChangeIt" Discussion ---------- [RFC][BC][FrameworkBundle] Force users to set "kernel.secret" to something unique Bug fix: kinda* Feature addition: no BC break: yes Symfony2 tests pass: yes Fixes the following tickets: #6480 License of the code: MIT This PR is to show different approach for "fix" suggested in #6480, as IMO there is no real point for "yet another listener" =) This PR also introduces BC break for all users that used default value for `kernel.secret`, but IMO it's worth it.
|
I disagree with this PR:
|
|
And also because on my laptop, I'll have to configure secret for all my applications, even if I don't care of security locally. |
|
Not sure I agree with this either... this is gonna break a bunch of sites when sysadmins upgrade their Symfony installations |
|
Right, this is a catch-22. People need to be able to use the interface to change the secret. Reverting for now. |
|
I'm still +1 on the event listener, as it only needs to be registered when the default secret is used and can be disabled the rest of the time (via compiler pass). Also, perhaps we could prompt the user or randomly generate a secret post-install using composer and Sensio DistributionBundle |
|
It's already present in distribution bundle, there's even a button to generate a random one. |
|
@alexandresalome: I meant as a post-install prompt in SensioDistributionBundle/Composer/ScriptHandler.php |
Bug fix: kinda*
Feature addition: no
BC break: yes
Symfony2 tests pass: yes
Fixes the following tickets: #6480
License of the code: MIT
This PR is to show different approach for "fix" suggested in #6480, as IMO there is no real point for "yet another listener" =)
This PR also introduces BC break for all users that used default value for
kernel.secret, but IMO it's worth it.