I have researched a bit, but I couldn't find a precise answer to why it's possible to write any string in $settings['hash_salt'].

For me it doesn't make sense that the site chashes if no hash salt has been set and if I then go to settings.php and write,

$settings['hash_salt'] = 'x';

the site works just fine.

Why does the site work just because hash salt have any value?


You can read about it in the default.settings.php file:

Salt for one-time login links, cancel links, form tokens, etc.

This variable will be set to a random value by the installer. All one-time login links will be invalidated if the value is changed. Note that if your site is deployed on a cluster of web servers, you must ensure that this variable has the same value on each server.

For enhanced security, you may set this variable to the contents of a file outside your document root; you should also ensure that this file is not stored with backups of your database.

This value is used by Drupal as salt for some cryptographic operations. It should be a random value. It adds more security to those cryptographic operations (as long as the value is not known by an attacker).

As far as I know Drupal uses a auto-generated salt value based on Database credentials when no salt is set, so Drupal should work without a salt value.


Drupal requires a settings key called hash_salt to secure transient hashes.

It will be generated during Drupal install and added to settings.php. If you use a different settings.php in different environments (for example, a settings.local.php), you may have forgotten to set this variable.

Add a line to your local settings.php like:

$settings['hash_salt'] = 'whatever you like';

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy