Secret key configuration in Flask - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of the SECRET_KEY in a Flask application?

The SECRET_KEY is used to secure sessions and protect against attacks like cookie tampering by signing cookies and other data.

beginner

How do you set the SECRET_KEY in a Flask app?

You set it by assigning a value to app.config['SECRET_KEY'], usually a long random string, before running the app.

intermediate

Why should the SECRET_KEY be kept secret and not hard-coded in public code?

If exposed, attackers can forge session cookies or other signed data, compromising app security. Keep it private and use environment variables or config files.

intermediate

What is a good way to generate a secure SECRET_KEY?

Use Python's secrets.token_hex(16) or similar to create a random 32-character hex string for strong security.

beginner

What happens if you don’t set a SECRET_KEY in Flask?

Flask will warn you, and session data won’t be securely signed, risking tampering and security issues.

What is the main use of SECRET_KEY in Flask?

A To set the app’s port number

B To connect to the database

C To sign session cookies and protect data integrity

D To define routes

The SECRET_KEY signs session cookies to prevent tampering.

Which of these is a secure way to generate a SECRET_KEY?

A Using <code>secrets.token_hex(16)</code>

B Using <code>random.randint(1,100)</code>

C Using your name as a string

D Using the current date

The secrets module generates cryptographically strong random strings.

Where should you store your Flask SECRET_KEY for best security?

A In the HTML templates

B Hard-coded in the main app file

C In the public GitHub repository

D In environment variables or a config file outside version control

Keeping the key outside public code prevents accidental exposure.

What might happen if the SECRET_KEY is leaked?

A The app will crash immediately

B Attackers can forge session cookies and impersonate users

C The app will run slower

D Nothing, it’s safe to share

Leaked keys allow attackers to create fake signed data.

How do you assign a secret key in Flask code?

A <code>app.config['SECRET_KEY'] = 'your-secret'</code>

B <code>app.secret = 'your-secret'</code>

C <code>app.key = 'your-secret'</code>

D <code>app.secret_key = 'your-secret'</code>

The correct way is to set app.config['SECRET_KEY'].

Explain why the SECRET_KEY is important in Flask and how you should manage it securely.

Think about protecting user sessions and keeping secrets out of public code.

Describe how to generate and set a strong SECRET_KEY in a Flask app.

Focus on secure random generation and configuration.