starred/shiori

Fork 0

mirror of https://github.com/go-shiori/shiori.git synced 2026-04-25 06:25:54 +03:00

[GH-ISSUE #782] SHIORI_HTTP_SECRET_KEY #374

New issue

Closed

opened 2026-02-25 23:34:05 +03:00 by kerem · 5 comments

kerem commented

2026-02-25 23:34:05 +03:00

Owner

Originally created by @LLKoder on GitHub (Nov 17, 2023).
Original GitHub issue: https://github.com/go-shiori/shiori/issues/782

Originally assigned to: @fmartingr on GitHub.

Data

Shiori version: last
Database Engine: sqlite
Operating system: ubuntu
CLI/Web interface/Web Extension: CLI

Describe the bug / actual behavior

When I run Shiori in docker I get some WARN error:

SHIORI_HTTP_SECRET_KEY is not set, using random value. This means that all sessions will be invalidated on server restart.

What do this error mean? How can I to fix it?

Originally created by @LLKoder on GitHub (Nov 17, 2023). Original GitHub issue: https://github.com/go-shiori/shiori/issues/782 Originally assigned to: @fmartingr on GitHub. ## Data - **Shiori version**: last - **Database Engine**: sqlite - **Operating system**: ubuntu - **CLI/Web interface/Web Extension**: CLI ## Describe the bug / actual behavior When I run Shiori in docker I get some WARN error: `SHIORI_HTTP_SECRET_KEY is not set, using random value. This means that all sessions will be invalidated on server restart.` What do this error mean? How can I to fix it?

kerem

2026-02-25 23:34:05 +03:00

closed this issue
added the
type:documentation
label

kerem commented

2026-02-25 23:34:05 +03:00

Author

Owner

@fmartingr commented on GitHub (Nov 17, 2023):

Hey @LLKoder, you need to set the SHIORI_HTTP_SECRET_KEY environment variable to something random to use as key for the session tokens. You can generate a pesudo-random string using openssl/pwgen or any number of tools online.

@fmartingr commented on GitHub (Nov 17, 2023): Hey @LLKoder, you need to set the `SHIORI_HTTP_SECRET_KEY` environment variable to something random to use as key for the session tokens. You can generate a pesudo-random string using `openssl`/`pwgen` or any number of tools online.

kerem commented

2026-02-25 23:34:05 +03:00

Author

Owner

@LLKoder commented on GitHub (Nov 17, 2023):

Hi, @fmartingr, do shiori need this key as unique every time when I start/restart service/system? Can you give a example please? I use shiori with docker.

Just I don't understand why this EVAR need users. If it don't use users why can shiori not generate it automatically?

@LLKoder commented on GitHub (Nov 17, 2023): Hi, @fmartingr, do `shiori` need this key as unique every time when I start/restart service/system? Can you give a example please? I use `shiori` with docker. Just I don't understand why this EVAR need users. If it don't use users why can `shiori` not generate it automatically?

kerem commented

2026-02-25 23:34:05 +03:00

Author

Owner

@fmartingr commented on GitHub (Nov 18, 2023):

Shiori generates one random every run, but for security purposes it must me set by the user. It is used to sign the sessions for the users (the authentication used to interact with the API).

How are you deploying shiori? docker compose/docker run? It something like this:

# Generate random string
$ openssl rand -hex 32
4c9598950d692a846977b5bc1dd31f3fed1afe1b3252cb8019e7aa914e2a1297

#  Run shiori
$ docker run --env SHIORI_HTTP_SECRET_KEY=4c9598950d692a846977b5bc1dd31f3fed1afe1b3252cb8019e7aa914e2a1297 ghcr.io/go-shiori/shiori:dev

@fmartingr commented on GitHub (Nov 18, 2023): Shiori generates one random every run, but for security purposes it must me set by the user. It is used to sign the sessions for the users (the authentication used to interact with the API). How are you deploying shiori? docker compose/docker run? It something like this: ``` # Generate random string $ openssl rand -hex 32 4c9598950d692a846977b5bc1dd31f3fed1afe1b3252cb8019e7aa914e2a1297 # Run shiori $ docker run --env SHIORI_HTTP_SECRET_KEY=4c9598950d692a846977b5bc1dd31f3fed1afe1b3252cb8019e7aa914e2a1297 ghcr.io/go-shiori/shiori:dev ```

kerem commented

2026-02-25 23:34:05 +03:00

Author

Owner

@LLKoder commented on GitHub (Nov 20, 2023):

@fmartingr, maybe don't need to close? This issue was remove from your tags either.

@LLKoder commented on GitHub (Nov 20, 2023): @fmartingr, maybe don't need to close? This issue was remove from your tags either.

kerem commented

2026-02-25 23:34:05 +03:00

Author

Owner

@fmartingr commented on GitHub (Nov 20, 2023):

Yeah leave it open for now so I use this as a reminder to properly update the docs 👍

@fmartingr commented on GitHub (Nov 20, 2023): Yeah leave it open for now so I use this as a reminder to properly update the docs 👍

kerem referenced this issue

2026-02-25 23:34:47 +03:00

[PR #374] [MERGED] Web Server Improvements #578