Security: plumb SESSION_SECRET into docker-compose and .env.example

claude-bot commented

2026-07-15 15:33:06 +00:00

Contributor

Split from #40. backend/app/config.py defaults SESSION_SECRET to change-me-in-production and three docs (setup, troubleshooting, ASVS review) tell users to override it — but it is absent from docker-compose.yml's environment block and .env.example, and no .env file is copied or mounted into the container. Every compose deployment silently signs session cookies with the hardcoded default.

Tasks

Add SESSION_SECRET=${SESSION_SECRET:?Set a random SESSION_SECRET} to docker-compose.yml (hard-fail beats silent insecurity)
Add SESSION_SECRET= with generation instructions (openssl rand -hex 32) to .env.example
Optional hardening: refuse startup (or log CRITICAL) when the default value is detected and DISABLE_AUTH is false
Rotate the secret on the dev server deployment after fixing

Split from #40. `backend/app/config.py` defaults `SESSION_SECRET` to `change-me-in-production` and three docs (setup, troubleshooting, ASVS review) tell users to override it — but it is absent from `docker-compose.yml`'s environment block and `.env.example`, and no `.env` file is copied or mounted into the container. **Every compose deployment silently signs session cookies with the hardcoded default.** ## Tasks - [ ] Add `SESSION_SECRET=${SESSION_SECRET:?Set a random SESSION_SECRET}` to `docker-compose.yml` (hard-fail beats silent insecurity) - [ ] Add `SESSION_SECRET=` with generation instructions (`openssl rand -hex 32`) to `.env.example` - [ ] Optional hardening: refuse startup (or log CRITICAL) when the default value is detected and `DISABLE_AUTH` is false - [ ] Rotate the secret on the dev server deployment after fixing

claude-bot added this to the v1.0.0 milestone

2026-07-15 15:33:06 +00:00

claude-bot added the

labels

2026-07-15 15:33:06 +00:00

claude-bot referenced this issue

2026-07-15 15:33:17 +00:00

Spec-compliance review (2026-07-15): findings & gap list #40

claude-bot commented

2026-07-15 22:36:26 +00:00

Author

Contributor

Picking this up alongside #41 (Wave 0). It's independent of the CI work (touches docker-compose.yml / .env.example), so running it in parallel.

rbrooks referenced this issue from a commit

2026-07-16 04:58:27 +00:00

Fix #42: require SESSION_SECRET, stop silently signing with default

claude-bot referenced this issue from a pull request that will close it,

2026-07-16 04:58:35 +00:00

Security: plumb SESSION_SECRET into compose and .env.example (#42) #67

claude-bot closed this issue

2026-07-16 05:23:01 +00:00

claude-bot referenced this issue from a commit

2026-07-16 05:23:03 +00:00

Security: plumb SESSION_SECRET into compose and .env.example (#42)

claude-bot commented

2026-07-16 05:23:24 +00:00

Author

Contributor

Merged via PR #67 (rebased onto the now-green main; the main.py overlap with #41 resolved). All CI green.

⚠️ Ops action required before the next dev-server deploy: compose now uses SESSION_SECRET=${SESSION_SECRET:?...}, so docker compose up will hard-fail unless SESSION_SECRET is set on the host. Before the next deploy to the dev server, add a real secret to its .env:

echo "SESSION_SECRET=$(openssl rand -hex 32)" >> .env   # on the dev host

This is the intended behavior (fail-closed beats silently signing with the default), but it means the deploy is gated on setting the secret. Flagging rather than doing it myself since it touches the live host — say the word and I'll handle it as part of the deploy work (pairs with #65).

Merged via PR #67 (rebased onto the now-green main; the `main.py` overlap with #41 resolved). All CI green. **⚠️ Ops action required before the next dev-server deploy:** compose now uses `SESSION_SECRET=${SESSION_SECRET:?...}`, so `docker compose up` will **hard-fail** unless `SESSION_SECRET` is set on the host. Before the next deploy to the dev server, add a real secret to its `.env`: ``` echo "SESSION_SECRET=$(openssl rand -hex 32)" >> .env # on the dev host ``` This is the intended behavior (fail-closed beats silently signing with the default), but it means the deploy is gated on setting the secret. Flagging rather than doing it myself since it touches the live host — say the word and I'll handle it as part of the deploy work (pairs with #65).

claude-bot referenced this issue

2026-08-31 04:50:37 +00:00

Deploy the dev server from the registry instead of building on the host (#65) #84

claude-bot referenced this issue

2026-08-31 05:42:07 +00:00

Deploy the dev server from registry images (compose pull) instead of building on the host #65

Rows
Columns

Security: plumb SESSION_SECRET into docker-compose and .env.example #42

Tasks