Bug Description
The Flask application does not raise an error when SECRET_KEY is missing from the environment. The app either uses Flask's built-in insecure default or a hardcoded fallback, allowing an attacker to forge session cookies.
Steps to Reproduce
- Start the server without setting
SECRET_KEY.
- Obtain a session cookie and run:
flask-unsign --decode --cookie '<cookie>'
flask-unsign --sign --secret '' --cookie '{"user": "admin"}'
- Observe: the forged cookie is accepted by the server.
Root Cause
# app.py
app.secret_key = os.environ.get('SECRET_KEY', 'changeme')Impact
Session forgery grants attacker any session identity, bypassing authentication.
Proposed Fix
secret = os.environ.get('SECRET_KEY')
if not secret or len(secret) < 32:
raise RuntimeError('SECRET_KEY must be set to at least 32 random characters')
app.secret_key = secret
Bug Description
The Flask application does not raise an error when
SECRET_KEYis missing from the environment. The app either uses Flask's built-in insecure default or a hardcoded fallback, allowing an attacker to forge session cookies.Steps to Reproduce
SECRET_KEY.Root Cause
Impact
Session forgery grants attacker any session identity, bypassing authentication.
Proposed Fix