fix: Change default SECRET_KEY, improve docs and banner warning on de…

docs/src/pages/docs/installation/configuring.mdx

@@ -21,7 +21,7 @@ SUPERSET_WEBSERVER_PORT = 8088
 
 # Flask App Builder configuration
 # Your App secret key
-SECRET_KEY = '\2\1thisismyscretkey\1\2\e\y\y\h'
+SECRET_KEY = 'USE_YOUR_OWN_SECURE_RANDOM_KEY'
 
 # The SQLAlchemy connection string to your database backend
 # This connection defines the path to the database that stores your
@@ -56,7 +56,8 @@ for more information on how to configure it.
 Make sure to change:
 
 - `SQLALCHEMY_DATABASE_URI`: by default it is stored at ~/.superset/superset.db
-- `SECRET_KEY`: to a long random string
+- `SECRET_KEY`: Use a strong complex alphanumeric string and use a tool
+ to help you generate a sufficiently random sequence, ex: openssl rand -base64 42"
 
 If you need to exempt endpoints from CSRF (e.g. if you are running a custom auth postback endpoint),
 you can add the endpoints to `WTF_CSRF_EXEMPT_LIST`:

superset/config.py

@@ -41,6 +41,7 @@
 from typing_extensions import Literal
 from werkzeug.local import LocalProxy
 
+from superset.constants import CHANGE_ME_SECRET_KEY
 from superset.jinja_context import BaseTemplateProcessor
 from superset.stats_logger import DummyStatsLogger
 from superset.typing import CacheConfig
@@ -160,8 +161,10 @@ def _try_json_readsha(filepath: str, length: int) -> Optional[str]:
 SQLALCHEMY_TRACK_MODIFICATIONS = False
 # ---------------------------------------------------------
 
-# Your App secret key
-SECRET_KEY = "\2\1thisismyscretkey\1\2\\e\\y\\y\\h"
+# Your App secret key. Make sure you override it on superset_config.py.
+# Use a strong complex alphanumeric string and use a tool to help you generate
+# a sufficiently random sequence, ex: openssl rand -base64 42"
+SECRET_KEY = CHANGE_ME_SECRET_KEY
 
 # The SQLAlchemy connection string.
 SQLALCHEMY_DATABASE_URI = "sqlite:///" + os.path.join(DATA_DIR, "superset.db")

superset/constants.py

@@ -22,6 +22,7 @@
 
 NULL_STRING = "<NULL>"
 
+CHANGE_ME_SECRET_KEY = "CHANGE_ME_TO_A_COMPLEX_RANDOM_SECRET"
 
 # UUID for the examples database
 EXAMPLES_DB_UUID = "a2dc77af-e654-49bb-b321-40f6b559a1ee"

superset/initialization/__init__.py

@@ -29,6 +29,7 @@
 from werkzeug.middleware.proxy_fix import ProxyFix
 
 from superset.connectors.connector_registry import ConnectorRegistry
+from superset.constants import CHANGE_ME_SECRET_KEY
 from superset.extensions import (
  _event_logger,
  APP_DIR,
@@ -572,12 +573,25 @@ def init_app_in_ctx(self) -> None:
 
  self.init_views()
 
+ def check_secret_key(self) -> None:
+ if self.config["SECRET_KEY"] == CHANGE_ME_SECRET_KEY:
+ logger.warning(80 * "-" + "\n" + 36 * " " + "WARNING\n" + 80 * "-")
+ logger.warning(
+ "A Default SECRET_KEY was detected please use superset_config.py "
+ "to override it.\n"
+ "Use a strong complex alphanumeric string and use a tool to help"
+ " you generate \n"
+ "a sufficiently random sequence, ex: openssl rand -base64 42"
+ )
+ logger.warning(80 * "-" + "\n" + 80 * "-")
+
  def init_app(self) -> None:
  """
  Main entry point which will delegate to other methods in
  order to fully init the app
  """
  self.pre_init()
+ self.check_secret_key()
  # Configuration of logging must be done first to apply the formatter properly
  self.configure_logging()
  # Configuration of feature_flags must be done first to allow init features