Generate new userAuthSalt for copied site

[SamC]

I need to propose a site next week so instead of going through the new install, I just copied my own site files + DB to a new subdomain and changed a few images and text etc. so I can crudely (and more importantly, quickly) show how it 'could' look.

The thing is, the install generates a userAuthSalt number, which is now identical on both these sites, as is the installed timestamp. I changed the httpHosts because the red warning was driving me nuts.

//config.php

$config->userAuthSalt = 'NUMBER_HERE'; 
$config->installed = NUMBER_HERE;
$config->httpHosts = array('MY_NEW_LAZY_SITE_URL');

The comments say:

/**
 * Installer: User Authentication Salt 
 * 
 * Must be retained if you migrate your site from one server to another
 * 
 */

If I get the go ahead, I will install and start from scratch, but does it matter about the userAuthSalt being the same on two sites? How do you generate a new one? Wordpress, for example, has a URL you can go to in order to get this information. Thanks for any additional info.

 

[Robin S]

I'm not sure about generating a new userAuthSalt, but in the future if you want to reuse an existing site as the starting point of a new site then check out the Site Profile Exporter module.

[horst]

I have 20+ site-copies with the same authsalt. (Mostly dev and stage copies). It works. I haven't looked into it, but I believe it is generated by the installer script. (So for security it would be better to have more unique authsalts, but for temporary dev or stage copies, it is ok for me)

You also may modify it in a way you like, but it should match the string-length and the allowed characters. Once you modified it in your site/config.php, you are not able to login with the existing accounts. But you can use the trick with resetting the password for the admin with a temporary codesnippet from within a template file. After that you can login as admin again, but maybe you have to resave / reassign passwords to the other user accounts, if any.

[szabesz]

39 minutes ago, SamC said:

does it matter about the userAuthSalt being the same on two sites?

By Ryan: "... the $config->userAuthSalt (which appears at the bottom of your /site/config.php file). That particular value is generated randomly when you first install ProcessWire. It is forever tied to the passwords as a secondary salt. It's not technically necessary to have it, and passwords are already blowfish'd, but I've always felt better having one part of the salt disconnected from the database itself. If that salt changes or is lost, then all the passwords are forever broken."

[SamC]

Thanks everyone. I wont worry about for now then, it's only a demo site.

14 hours ago, Robin S said:

I'm not sure about generating a new userAuthSalt, but in the future if you want to reuse an existing site as the starting point of a new site then check out the Site Profile Exporter module.

Does this work on PW 3.0 though? One part says:

Compatibility 2.5, 2.6, 2.7

but further down says:

This version of the profile exporter requires ProcessWire 2.5 or newer.

Could do with understanding the modules information pages a bit better, has stopped me so far from trying anything so far. After Drupal though, it's so nice to be able to achieve so much already with no added modules at all, it's fair to say PW has really re-ignited my dwindling passion for web design again.

[szabesz]

9 hours ago, SamC said:

23 hours ago, Robin S said:

I'm not sure about generating a new userAuthSalt, but in the future if you want to reuse an existing site as the starting point of a new site then check out the Site Profile Exporter module.

Does this work on PW 3.0 though? One part says:

It should. See: https://github.com/processwire/processwire-issues/issues/75

[SamC]

I'lll give it a go next time I need to start a new site. In fact, that might be soon as I want to test this

https://processwire.com/blog/posts/processwire-3.0.49-introduces-a-new-template-file-strategy/