메뉴얼:$wgSecretKey
| Security: $wgSecretKey | |
|---|---|
| This should always be customized to a secret, unique string in LocalSettings.php. |
|
| 이 변수가 소개된 버전: | 1.4.0 |
| 이 변수가 사라진 버전: | 계속해서 쓰이고 있음 |
| 허용값: | (string) |
| 기본값: | false |
| 기타 설정: 알파벳 순 | 기능별 순 | |
상세
This should always be customized to a secret, unique string in LocalSettings.php.
Installer.php sets it to a 64-character random string generated by MWCryptRand::generateHex( 64 );
When no better sources of entropy are available to MediaWiki, this value is used as a source of cryptographic entropy when generating user_token(s) to insert into the user table which is used as a persistent cookie for authentication (when a user checks "Remember my login on this browser") that is resilient to spoofing. On modern PHP versions with access to /dev/urandom, mcrypt random, or openssl random, these functions are used in lieu of this variable for the purpose of token generation. However this variable is still used for other purposes, so it is still very important it be set to a unique random value even on modern PHP.
 경고: | 만약 이 값이 유출된다면 당신은 반드시 새로운 키를 생성해야 합니다. |
$wgProxyKey
From 1.3 to 1.4, $wgProxyKey was the documented setting for this. In 1.4, this was marked as deprecated in favor of $wgSecretKey. In 1.24, $wgProxyKey was removed (yes, it really did take almost 10 years to remove).