Repository navigation
ADR 0015: Keep the salt fallback, and generate a key at install - #14
Merged
Merged
Conversation
Rotating the salts locks every secret on a site that derives its key from LOGGED_IN_KEY and LOGGED_IN_SALT, as #66187 comment:23 raised and comment:24 confirmed on 7.2-beta2. ADR 0015 keeps the fallback, since removing it pushes consumers back to plaintext options, and records the fix for new installs: setup-config.php writes a dedicated WP_SECRETS_KEY, proposed in core as #66399. It also records why wp-config-sample.php gets no placeholder, and how an existing site moves off the fallback with wp secret rotate.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Records the decision behind the reply on #66187 comment:23 and comment:24: rotating the salts makes every secret unreadable on a site that derives its key from
LOGGED_IN_KEYandLOGGED_IN_SALT.What it guarantees
Nothing in
src/changes. The ADR settles what the plugin and core do about the fallback, so the next reviewer who asks to remove it gets the reasoning:wp_set_secret()returnWP_Erroron nearly every 7.2 site, and consumers would store the credential as a plaintext option instead.setup-config.phpwrites a base64-encoded random 32-byteWP_SECRETS_KEYafter the salts, outside their "change these at any time" docblock group. Core ticket: #66399.wp-config-sample.phpgets no placeholder. The keyring hashes anyWP_SECRETS_KEYstring, so a placeholder would become a public key on every hand-edited install that left it alone.The consequences section names what remains: existing sites and other installers keep the fallback,
wp secret rotateis the only way off it until core has a public path in 7.3, and the dev note has to warn about salt rotation.Testing
npm run buildinsite/renders/decisions/0015-…/.