Skip to content

Improved the explanation about the "secret" configuration parameter #5109

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Apr 27, 2015
Merged

Improved the explanation about the "secret" configuration parameter #5109

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
b13250d
Improved the explanation about the "secret" configuration parameter
javiereguiluz Mar 24, 2015
4bbd84a
Fixed some typos
javiereguiluz Mar 24, 2015
74841e6
Minor rewording
javiereguiluz Mar 24, 2015
db5db0f
Fixed a minor grammar issue
javiereguiluz Mar 25, 2015
ac3a74d
Minor rewording
javiereguiluz Apr 17, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 18 additions & 4 deletions reference/configuration/framework.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,10 +60,24 @@ secret

**type**: ``string`` **required**

This is a string that should be unique to your application. In practice,
it's used for generating the CSRF tokens, but it could be used in any other
context where having a unique string is useful. It becomes the service container
parameter named ``kernel.secret``.
This is a string that should be unique to your application and it's commonly used
to add more entropy to security related operations. Its value should be a series of
characters, numbers and symbols chosen randomly and the recommended length is
around 32 characters.

In practice, Symfony uses this value for generating the :ref:`CSRF tokens <forms-csrf>`,
for encrypting the cookies used in the :doc:`remember me functionality </cookbook/security/remember_me>`
and for creating signed URIs when using :ref:`ESI (Edge Side Includes) <edge-side-includes>` .

This option becomes the service container parameter named ``kernel.secret``,
which you can use whenever the application needs an immutable random string
to add more entropy.

As with any other security-related parameter, it is a good practice to change this
value from time to time. However, keep in mind that changing this value will
invalidate all signed URIs and Remember Me cookies. That's why, after changing
this value, you should regenerate the application cache and log out all the
application users.

.. _configuration-framework-http_method_override:

Expand Down