## Why is this an issue?

Secret keys are used in combination with an algorithm to encrypt data. A typical use case is an authentication system. For such a system to be secure, the secret key should have a value which cannot be guessed and which is long enough to not be vulnerable to brute-force attacks.

A "salt" is an extra piece of data which is included when hashing data such as a password. Its value should have the same properties as a secret key.

This rule raises an issue when it detects that a secret key or a salt has a predictable value or that it’s not long enough.

### Noncompliant code example

WordPress:

    define('AUTH_KEY', 'hello'); // Noncompliant
    define('AUTH_SALT', 'hello'); // Noncompliant
    define('AUTH_KEY', 'put your unique phrase here'); // Noncompliant, this is the default value

### Compliant solution

WordPress:

    define('AUTH_KEY', 'D&ovlU#|CvJ##uNq}bel+^MFtT&.b9{UvR]g%ixsXhGlRJ7q!h}XWdEC[BOKXssj');
    define('AUTH_SALT', 'FIsAsXJKL5ZlQo)iD-pt??eUbdc{_Cn<4!d~yqz))&B D?AwK%)+)F2aNwI|siOe');

## Resources

- OWASP - Top 10 2021 Category A2 - Cryptographic Failures
- wordpress.org - WordPress Security Keys