Secret keys are used in combination with an algorithm to encrypt data. A typical use case is an authentication system. For such a system to be
secure, the secret key should have a value which cannot be guessed and which is long enough to not be vulnerable to brute-force attacks.
A "salt" is an extra piece of data which is included when hashing data such as a password. Its value should have the same properties as a secret
key.
This rule raises an issue when it detects that a secret key or a salt has a predictable value or that it’s not long enough.
Noncompliant code example
WordPress:
define('AUTH_KEY', 'hello'); // Noncompliant
define('AUTH_SALT', 'hello'); // Noncompliant
define('AUTH_KEY', 'put your unique phrase here'); // Noncompliant, this is the default value
Compliant solution
WordPress:
define('AUTH_KEY', 'D&ovlU#|CvJ##uNq}bel+^MFtT&.b9{UvR]g%ixsXhGlRJ7q!h}XWdEC[BOKXssj');
define('AUTH_SALT', 'FIsAsXJKL5ZlQo)iD-pt??eUbdc{_Cn<4!d~yqz))&B D?AwK%)+)F2aNwI|siOe');
