手册:$wgSecretKey
| 安全: $wgSecretKey | |
|---|---|
| 这必须始终被设置成一个保密且唯一的 LocalSettings.php 中的字符串。 |
|
| 引进版本： | 1.4.0 |
| 移除版本： | 仍在使用 |
| 允许的值： | (字符串) |
| 默认值： | false |
| 其他设置： 按首字母排序 | 按功能排序 | |
详情
这必须始终被设置成一个保密且唯一的 LocalSettings.php 中的字符串。
Installer.php 把它设置为通过 MWCryptRand::generateHex( 64 ); 产生的 64 字符的随机字符串。
When no better sources of entropy are available to MediaWiki, this value is used as a source of cryptographic entropy when generating user_token(s) to insert into the user table which is used as a persistent cookie for authentication (when a user checks "Remember my login on this browser") that is resilient to spoofing. On modern PHP versions with access to /dev/urandom, mcrypt random, or openssl random, these functions are used in lieu of this variable for the purpose of token generation. However this variable is still used for other purposes, so it is still very important it be set to a unique random value even on modern PHP.
 警告： | If the value of the variable leaks out you should generate a new secret key. |
$wgProxyKey
From 1.3 to 1.4, $wgProxyKey was the documented setting for this. In 1.4, this was marked as deprecated in favor of $wgSecretKey. In 1.24, $wgProxyKey was removed (yes, it really did take almost 10 years to remove).