Refuse to start OIDC mode with the default SESSION_SECRET #28

New issue

Open

opened 2026-07-17 03:07:20 +00:00 by claude-bot · 1 comment

claude-bot commented

2026-07-17 03:07:20 +00:00

Contributor

backend/src/config.js:10 defaults sessionSecret to dev-only-change-me, and docker-compose.full.yml:19 bakes the same constant in as the env fallback, so an OIDC deployment that misses one env var signs its session cookies (backend/src/auth.js:9-19) with a value that is public on the internet. Sessions are the entire authorization basis (auth.js:64).

Fix: on startup, when AUTH_MODE != disabled, require a non-empty SESSION_SECRET that differs from the dev constant — otherwise exit with an actionable error. Remove the fallback from docker-compose.full.yml (leave it only for AUTH_MODE=disabled dev). Document in README.

Acceptance criteria

Backend refuses to start in OIDC mode with missing/default secret
Compose no longer supplies the dev constant when auth is enabled
README documents the requirement

Relations: relates to #8 (deployment config task will set the real secret)

(Audit finding F-07, 2026-07-16 — Severity: High, Confidence: High)

`backend/src/config.js:10` defaults `sessionSecret` to `dev-only-change-me`, and `docker-compose.full.yml:19` bakes the same constant in as the env fallback, so an OIDC deployment that misses one env var signs its session cookies (`backend/src/auth.js:9-19`) with a value that is public on the internet. Sessions are the entire authorization basis (`auth.js:64`). Fix: on startup, when `AUTH_MODE != disabled`, require a non-empty SESSION_SECRET that differs from the dev constant — otherwise exit with an actionable error. Remove the fallback from `docker-compose.full.yml` (leave it only for `AUTH_MODE=disabled` dev). Document in README. **Acceptance criteria** - [ ] Backend refuses to start in OIDC mode with missing/default secret - [ ] Compose no longer supplies the dev constant when auth is enabled - [ ] README documents the requirement **Relations:** relates to #8 (deployment config task will set the real secret) *(Audit finding F-07, 2026-07-16 — Severity: High, Confidence: High)*

claude-bot added this to the v1.1.0 - Test & Ops Hardening milestone

2026-07-17 03:10:44 +00:00

claude-bot added the

ops

security

labels

2026-07-17 03:11:43 +00:00

claude-bot commented

2026-07-17 15:21:14 +00:00

Author

Contributor

Sequencing (from the 2026-07-16 audit): land this before #8 (configuring Authentik env vars on the deployment host). With this fail-fast check in place, the #8 deploy fails loudly if SESSION_SECRET is missing — instead of silently coming up with cookies signed by the public dev constant.

**Sequencing (from the 2026-07-16 audit):** land this **before #8** (configuring Authentik env vars on the deployment host). With this fail-fast check in place, the #8 deploy fails loudly if `SESSION_SECRET` is missing — instead of silently coming up with cookies signed by the public dev constant.

claude-bot referenced this issue

2026-07-17 15:21:14 +00:00

Configure Authentik env vars on deployment host and verify OIDC callback behind Caddy #8