Security Test: Weak Flask Session Secret¶

Scanner(s) Support¶

Description¶

Default Severity: high

Flask uses the SECRET_KEY value to cryptographically sign cookies and other data. If this key is weak, short, guessable, or left as the default, attackers can forge or tamper with session cookies, leading to account takeover, privilege escalation, or data exposure. This issue often occurs when developers use placeholder keys, store them in source control, or generate them from predictable sources.

Reference:

• https://flask.palletsprojects.com/en/latest/config/#SECRET_KEY
  • https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html

Configuration¶

Identifier: frontend_configuration/weak_flask_secret

Examples¶

All configuration available:

checks:
  frontend_configuration/weak_flask_secret:
    skip: false # default

Compliance and Standards¶