SHIORI_HTTP_SECRET_KEY about shiori

[fmartingr]

Shiori generates one random every run, but for security purposes it must me set by the user. It is used to sign the sessions for the users (the authentication used to interact with the API).

How are you deploying shiori? docker compose/docker run? It something like this:

# Generate random string
$ openssl rand -hex 32
4c9598950d692a846977b5bc1dd31f3fed1afe1b3252cb8019e7aa914e2a1297

#  Run shiori
$ docker run --env SHIORI_HTTP_SECRET_KEY=4c9598950d692a846977b5bc1dd31f3fed1afe1b3252cb8019e7aa914e2a1297 ghcr.io/go-shiori/shiori:dev

[fmartingr]

Hey @LLKoder, you need to set the SHIORI_HTTP_SECRET_KEY environment variable to something random to use as key for the session tokens. You can generate a pesudo-random string using openssl/pwgen or any number of tools online.

[LLKoder]

Hi, @fmartingr, do shiori need this key as unique every time when I start/restart service/system? Can you give a example please? I use shiori with docker.

Just I don't understand why this EVAR need users. If it don't use users why can shiori not generate it automatically?

[LLKoder]

@fmartingr, maybe don't need to close? This issue was remove from your tags either.

[fmartingr]

Yeah leave it open for now so I use this as a reminder to properly update the docs 👍