From 0c556d98ed54993f888f77b4bc2d7e3a2e18dbad Mon Sep 17 00:00:00 2001 From: Inkcha Date: Mon, 27 Jul 2026 19:30:43 -0400 Subject: [PATCH] fix: validate SESSION_SECRET in production to prevent fallback-to-insecure The sessionSecret defaulted to a hardcoded dev-only value if SESSION_SECRET env var was not set. In production this means anyone knowing the default can forge session tokens. This change throws a startup error in production if SESSION_SECRET is missing, while preserving the dev fallback for local development. Fixes the HIGH severity issue reported in #88 --- apps/web/lib/env.ts | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/apps/web/lib/env.ts b/apps/web/lib/env.ts index 049ad6c..847dfe5 100644 --- a/apps/web/lib/env.ts +++ b/apps/web/lib/env.ts @@ -19,7 +19,13 @@ export const env = { return this.nodeEnv === "production"; }, sessionSecret: - process.env.SESSION_SECRET || "dev-only-insecure-change-me-0000000000000000", + (() => { + const val = process.env.SESSION_SECRET; + if (!val && process.env.NODE_ENV === "production") { + throw new Error("SESSION_SECRET must be set in production"); + } + return val || "dev-only-insecure-change-me-0000000000000000"; + })(), adminEmails: (process.env.ADMIN_EMAILS || "anthony@profullstack.com") .split(",") .map((e) => e.trim().toLowerCase())