{"record":{"id":"32586e2f3056edea","repo":"mlflow/mlflow","slug":"a-static-secret-key-needs-to-be-set-for-csrf-prote","errorCode":null,"errorMessage":"A static secret key needs to be set for CSRF protection. Please set the `MLFLOW_FLASK_SERVER_SECRET_KEY` environment variable before starting the server. For example:\n\nexport MLFLOW_FLASK_SERVER_SECRET_KEY='my-secret-key'\n\nIf you are using multiple servers, please ensure this key is consistent between them, in order to prevent validation issues.","messagePattern":"A static secret key needs to be set for CSRF protection\\. Please set the `MLFLOW_FLASK_SERVER_SECRET_KEY` environment variable before starting the server\\. For example:\n\nexport MLFLOW_FLASK_SERVER_SECRET_KEY='my-secret-key'\n\nIf you are using multiple servers, please ensure this key is consistent between them, in order to prevent validation issues\\.","errorType":"exception","errorClass":"MlflowException","httpStatus":null,"severity":"critical","filePath":"mlflow/server/auth/__init__.py","lineNumber":5865,"sourceCode":"\n    Args:\n        app: The Flask app to enable authentication and authorization for.\n\n    Returns:\n        The app with authentication and authorization enabled.\n    \"\"\"\n    global _auth_initialized\n\n    _logger.warning(\n        \"This feature is still experimental and may change in a future release without warning\"\n    )\n\n    # a secret key is required for flashing, and also for\n    # CSRF protection. it's important that this is a static key,\n    # otherwise CSRF validation won't work across workers.\n    secret_key = MLFLOW_FLASK_SERVER_SECRET_KEY.get()\n    if not secret_key:\n        raise MlflowException(\n            \"A static secret key needs to be set for CSRF protection. Please set the \"\n            \"`MLFLOW_FLASK_SERVER_SECRET_KEY` environment variable before starting the \"\n            \"server. For example:\\n\\n\"\n            \"export MLFLOW_FLASK_SERVER_SECRET_KEY='my-secret-key'\\n\\n\"\n            \"If you are using multiple servers, please ensure this key is consistent between \"\n            \"them, in order to prevent validation issues.\"\n        )\n    app.secret_key = secret_key\n\n    # we only need to protect the CREATE_USER_UI route, since that's\n    # the only browser-accessible route. the rest are client / REST\n    # APIs that do not have access to the CSRF token for validation\n    app.config[\"WTF_CSRF_CHECK_DEFAULT\"] = False\n    csrf = CSRFProtect()\n    csrf.init_app(app)\n\n    store.init_db(\n        auth_config.database_uri,","sourceCodeStart":5847,"sourceCodeEnd":5883,"githubUrl":"https://github.com/mlflow/mlflow/blob/6a27f2decc0b76eb1b54af31849784addb357dbc/mlflow/server/auth/__init__.py#L5847-L5883","documentation":"MLflow's Flask auth server requires a static secret key for session signing, message flashing, and CSRF protection. The key is read from the `MLFLOW_FLASK_SERVER_SECRET_KEY` environment variable; if unset, server startup raises this error because CSRF tokens would not validate consistently across workers with an ephemeral key.","triggerScenarios":"Starting the MLflow server with `--app-name basic-auth` (auth enabled) without the `MLFLOW_FLASK_SERVER_SECRET_KEY` environment variable set.","commonSituations":"First-time auth setup where the env var was not exported; running under systemd/Docker/Kubernetes where the env var was not propagated into the container; multiple workers started with a per-worker random key.","solutions":["Set the environment variable before starting: `export MLFLOW_FLASK_SERVER_SECRET_KEY='my-secret-key'`.","Add the variable to your Dockerfile/compose/systemd unit so it reaches the server process.","Use the same static key across all servers/workers to avoid CSRF validation mismatches."],"exampleFix":"// before\nmlflow server --app-name basic-auth\n// after\nexport MLFLOW_FLASK_SERVER_SECRET_KEY='my-secret-key'\nmlflow server --app-name basic-auth","handlingStrategy":"validation","validationCode":"import os, sys\nif not os.environ.get(\"MLFLOW_FLASK_SERVER_SECRET_KEY\"):\n    sys.exit(\"MLFLOW_FLASK_SERVER_SECRET_KEY must be set before starting the auth server\")","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Export the secret key in every environment that launches the server (Docker, systemd, k8s manifests)","Share one static key across all replicas/workers","Add a startup smoke test that fails fast when auth is enabled without the key"],"tags":["auth","csrf","configuration","env-var","startup"],"backgroundTag":"missing-env-var","analyzedSha":"6a27f2decc0b76eb1b54af31849784addb357dbc","analyzedAt":"2026-08-29T20:54:51.419Z","schemaVersion":2},"datasetVersion":"2026-08-29T22:17:34.462Z"}