Prevent using unsecure secret

camptocamp · Jun 25, 2019 · 5b4ae74 · 5b4ae74
1 parent e5241de
commit 5b4ae74
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/geoportal/c2cgeoportal_geoportal/lib/authentication.py b/geoportal/c2cgeoportal_geoportal/lib/authentication.py
@@ -44,6 +44,10 @@ def create_authentication(settings):
     http_only = http_only.lower() in ("true", "yes", "1")
     secure = settings.get("authtkt_secure", "True")
     secure = secure.lower() in ("true", "yes", "1")
+    if len(settings["authtkt_secret"]) < 64:
+        raise Exception('"authtkt_secret should be at least 64 characters.'
+                        'See https://docs.pylonsproject.org/projects/pyramid/en/latest/api/session.html')
+
     cookie_authentication_policy = AuthTktAuthenticationPolicy(
         settings["authtkt_secret"],
         callback=defaultgroupsfinder,