Drupal Answers is a question and answer site for Drupal developers and administrators. It only takes a minute to sign up.
Sign up to join this community
I have researched a bit, but I couldn't find a precise answer to why it's possible to write any string in $settings['hash_salt'].
For me it doesn't make sense that the site chashes if no hash salt has been set and if I then go to settings.php and write,
$settings['hash_salt'] = 'x';
the site works just fine.
Why does the site work just because hash salt have any value?
You can read about it in the default.settings.php file:
Salt for one-time login links, cancel links, form tokens, etc.
This variable will be set to a random value by the installer. All one-time login links will be invalidated if the value is changed. Note that if your site is deployed on a cluster of web servers, you must ensure that this variable has the same value on each server.
For enhanced security, you may set this variable to the contents of a file outside your document root; you should also ensure that this file is not stored with backups of your database.
This value is used by Drupal as salt for some cryptographic operations. It should be a random value. It adds more security to those cryptographic operations (as long as the value is not known by an attacker).
As far as I know Drupal uses a auto-generated salt value based on Database credentials when no salt is set, so Drupal should work without a salt value.
Drupal requires a settings key called hash_salt to secure transient hashes.
It will be generated during Drupal install and added to settings.php. If you use a different settings.php in different environments (for example, a settings.local.php), you may have forgotten to set this variable.
Add a line to your local settings.php like:
$settings['hash_salt'] = 'whatever you like';
