This is the code in settings.php

$drupal_hash_salt = '';

From what I know it should be a random string and I shouldn't change it at all and it has a direct effect on the website security. But why this variable is empty? Is there any problem and what should I do to assign a string to this variable?

  • Why do you think you shouldn't change it? In case of a breach, do change this value.
    – AKS
    May 29 '14 at 17:55

The hash is used to salt things one-time links and forms tokens, it filed usually by the installer.

You can add your own salt here, basically any random string or even replace it with the content of a file (see the documentation in the default.settings.php).

If this variable is empty, a hash of the serialized database credentials will be used as a fallback salt (though you have to add it manually if you have a database cluster).

This is function used as a fall back if there is no salt drupal_hash_salt

function drupal_get_hash_salt() {
  global $drupal_hash_salt, $databases;
  // If the $drupal_hash_salt variable is empty, a hash of the serialized
  // database credentials is used as a fallback salt.
  return empty($drupal_hash_salt) ? hash('sha256', serialize($databases)) : $drupal_hash_salt;
  • so you mean it is not a security hole? yes ?
    – M a m a D
    May 29 '14 at 17:46
  • 1
    no since the hash is the seeded with your database connection string it is unique to that site. and you can run the code hash('sha256', serialize($databases)) and add the output to settings.php
    – m.khamash
    May 29 '14 at 17:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.