Upgraded your self-hosted Dify? Your .env may still have the SECRET_KEY everyone else has

说明与用途

升级 Dify 后，.env 可能仍包含公共 SECRET_KEY，攻击者可利用其签署令牌。更换密钥可保障安全，但会导致用户登出并使文件 URL 失效。

问题

After upgrading Dify, the .env file may still contain a public SECRET_KEY that was shipped with older releases, allowing anyone to sign tokens and compromise the instance.

结果

Replacing the public SECRET_KEY protects the instance from token forgery, invalidates existing sessions and file URLs, and requires OAuth integrations to be reauthorized.

工作流

• Check if the .env contains the old key using grep
• If present, back up the .env
• Generate a new key with openssl rand -base64 42 and replace the line in .env
• Restart the containers with docker compose up -d
• Notify users of logout and reauthorization requirements

证据

Up to Dify 1.14.x, docker/.env.example shipped a fixed SECRET_KEY, a long string starting sk-9f73s3lj

来源

What the key does, from Dify's environment variable docs: it's used for "session cookie signing, JWT authentication tokens, file URL signatures (HMAC-SHA256), and encrypting third-party OAuth credentials"

来源

Changing the key "will immediately log out all users, invalidate all file URLs", and OAuth-based plugin integrations must be authorized again because "their encrypted credentials become unrecoverable"

来源