f4d6d51a09
A secret key generated by the nixos module was misspelled, which could possibly impact the security of session cookies. To recover from this situation we will wipe all security keys that were previously generated by the NixOS module, when the misspelled one is found. This will result in all session cookies being invalidated. This is confirmed by the wordpress documentation: > You can change these at any point in time to invalidate all existing > cookies. This does mean that all users will have to login again. https://wordpress.org/support/article/editing-wp-config-php/#security-keys Meanwhile this issue shouldn't be too grave, since the salting function of wordpress will rely on the concatenation of both the user-provided and automatically generated values, that are stored in the database. > Secret keys are located in two places: in the database and in the > wp-config.php file. The secret key in the database is randomly > generated and will be appended to the secret keys in wp-config.php. https://developer.wordpress.org/reference/functions/wp_salt/ Fixes: 2adb03fdaea6186299c6ff578bb6814d8f3bb30b ("nixos/wordpress: generate secrets locally") Reported-by: Moritz Hedtke <Moritz.Hedtke@t-online.de> (cherry picked from commit 724ed08df02546fea2ab38613d615dd47461528c)
*** NixOS *** NixOS is a Linux distribution based on the purely functional package management system Nix. More information can be found at https://nixos.org/nixos and in the manual in doc/manual.