Hello,
you may force-push a new commit that removes the settings file from the GitHub repo, but if you are really paranoid, you may want to change your CSRF token in production immediately. It may cause some temporary annoyance to your users, but nothing long-term.
Best,
Gergely
2015-09-25 8:03 GMT+02:00 Gordon Reeder <greeder59@gmail.com>:
I'm learning Django and still very new at it. And like a newbie, I may have made a newbie goof.--
I have leaked my CSRF token.
I am building up a web site with Django which I have under revision control with Git. I have pushed two commits of the project out to Github. The commits included the settings.py file, which list the CSRF token. I have read (after the fact) that maybe that wasn't the smartest thing to do.
So now what?
Can I remove the settings.py file from Github?
Or can I generate a new CSRF token?
Any suggestions?
You received this message because you are subscribed to the Google Groups "Django users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-users+unsubscribe@googlegroups.com.
To post to this group, send email to django-users@googlegroups.com.
Visit this group at http://groups.google.com/group/django-users.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/9faaf7ad-29af-473d-8e63-e1c51b4b90d0%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
You received this message because you are subscribed to the Google Groups "Django users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to django-users+unsubscribe@googlegroups.com.
To post to this group, send email to django-users@googlegroups.com.
Visit this group at http://groups.google.com/group/django-users.
To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/CACczBULGV4cYYQ_9s2JjGCNOGRqg5Ga2rTgu%3D85cC%3DMnp20X3A%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.
No comments:
Post a Comment