From: Dylan William Hardison <dylan@hardison.net>
Date: Mon, 10 Dec 2018 20:42:17 +0000 (-0500)
Subject: no bug - add jwt_secret to README
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3798a4758cb7733449c9abcc1cec7369320fe1bf;p=thirdparty%2Fbugzilla.git

no bug - add jwt_secret to README
---

diff --git a/README.rst b/README.rst
index 1b556d915..e19bc274e 100644
--- a/README.rst
+++ b/README.rst
@@ -342,6 +342,13 @@ BMO_site_wide_secret
   security features in Bugzilla, to protect against certain types of attacks.
   It's very important that this key is kept secret.
 
+BMO_jwt_secret
+  This secret key is used by your installation for the creation and validation
+  of jwts.  It's very important that this key is kept secret and it should be
+  different from the side_wide_secret. Changing this will invalidate all issued
+  jwts, so all oauth clients will need to start over. As such it should be a
+  high level of entropy, as it probably won't change for a very long time.
+
 BMO_inbound_proxies
   This is a list of IP addresses that we expect proxies to come from.
   This can be '*' if only the load balancer can connect to this container.