django__django-16631

SECRET_KEY_FALLBACKS is not used for sessions

Verdict: the issue points to the file or function that was changed (Tier B).

In particular for user sessions, using fallback keys in the AuthenticationMiddleware/auth.get_user(request) will keep existing _auth_user_hash values from before the rotation being seen as valid

The text points to the exact place to change: “When looking at the Django source code, I see that the ​salted_hmac function uses the SECRET_KEY by default and the ​AbstractBaseUser.get_session_auth_hash method does n…”

All SWE-bench Verified tasks · more django/django tasks · How the check works