URI.MungeSecretKey

TYPE: string/null

VERSION: 3.1.1

DEFAULT: NULL

--DESCRIPTION--

<p>

    This directive enables secure checksum generation along with %URI.Munge.

    It should be set to a secure key that is not shared with anyone else.

    The checksum can be placed in the URI using %t. Use of this checksum

    affords an additional level of protection by allowing a redirector

    to check if a URI has passed through HTML Purifier with this line:

</p>



<pre>$checksum === hash_hmac("sha256", $url, $secret_key)</pre>



<p>

    If the output is TRUE, the redirector script should accept the URI.

</p>



<p>

    Please note that it would still be possible for an attacker to procure

    secure hashes en-mass by abusing your website's Preview feature or the

    like, but this service affords an additional level of protection

    that should be combined with website blacklisting.

</p>



<p>

    Remember this has no effect if %URI.Munge is not on.

</p>

--# vim: et sw=4 sts=4

