Upgraded your self-hosted Dify? Your .env may still have the SECRET_KEY everyone else has

说明与用途

升级 Dify 后，.env 文件可能仍包含公共 SECRET_KEY，攻击者可用其签署令牌。请将其替换为唯一密钥，以保护会话、JWT 和 OAuth 凭证。

问题

After upgrading Dify, the .env file may still contain a public SECRET_KEY that was shipped with older releases, allowing attackers to sign tokens and compromise the instance.

结果

Replacing the public SECRET_KEY secures the Dify instance against token forgery and credential compromise, while also prompting necessary user notifications and re-authorizations.

工作流

• 1. Verify if the old key is present: grep -c '^SECRET_KEY=sk-9f73s3lj' dify/docker/.env
• 2. If count is 1, replace the key: cd dify/docker && cp .env .env.bak && sed -i "s|^SECRET_KEY=.*|SECRET_KEY=$(openssl rand -base64 42)|" .env && docker compose up -d
• 3. Inform users that changing the key will log them out and invalidate file URLs and OAuth integrations.
• 4. Optionally adjust other .env settings: expose ports, set CONSOLE_CORS_ALLOW_ORIGINS, set INIT_PASSWORD, and change default Postgres/Redis passwords.

证据

Up to Dify 1.14.x, docker/.env.example shipped a fixed SECRET_KEY, a long string starting sk-9f73s3lj

来源

What the key does, from Dify's environment variable docs: it's used for "session cookie signing, JWT authentication tokens, file URL signatures (HMAC-SHA256), and encrypting third-party OAuth credentials"

来源

Changing the key "will immediately log out all users, invalidate all file URLs", and OAuth-based plugin integrations must be authorized again because "their encrypted credentials become unrecoverable"

来源