Improve the description of CREDENTIAL_ROUNDS

3 years ago · 20d2b621aa
parent df230cb482
commit 20d2b621aa
1 changed files with 1 additions and 1 deletions
--- a/docs/configuration.rst
+++ b/docs/configuration.rst
@ -138,7 +138,7 @@ Depending on your particular deployment you most probably will want to change th
 Advanced settings
 -----------------

-The ``CREDENTIAL_ROUNDS`` (default: 12) is the number of rounds used by the password hashing scheme. You should use the default value.
+The ``CREDENTIAL_ROUNDS`` (default: 12) setting is the number of rounds used by the password hashing scheme. The number of rounds can be reduced in case faster authentication is needed or increased when additional protection is desired. Keep in mind that this is a mitigation against offline attacks on password hashes, aiming to prevent credential stuffing (due to password re-use) on other systems.

 The ``SESSION_COOKIE_SECURE`` (default: True) setting controls the secure flag on the cookies of the administrative interface. It should only be turned off if you intend to access it over plain HTTP.