Skip to content

Fix Security Vulnerability by Validating AUTH_SECRET and ENCRYPTION_KEY #8989

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Rakshak05 wants to merge 2 commits into
base: main
Choose a base branch
from
+36 −0
Open

Fix Security Vulnerability by Validating AUTH_SECRET and ENCRYPTION_KEY #8989

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3d1d2bf
Resolves issue-#7718
Rakshak05 Aug 10, 2026
1ac2ac4
Merge branch 'main' into issue-#7718
Rakshak05 Aug 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions lib/validate-env.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,24 @@ describe('validateCriticalEnv — AUTH_SECRET errors', () => {
expect(result.valid).toBe(false);
expect(result.errors[0]).toMatch(/31 chars/);
});

it('returns an error when AUTH_SECRET is set to fallback-secret', () => {
const result = validateCriticalEnv(validEnv({ AUTH_SECRET: 'fallback-secret' }));
expect(result.valid).toBe(false);
expect(result.errors[0]).toMatch(
/AUTH_SECRET environment variable must be set to a secure value/
);
});

it('returns an error when AUTH_SECRET contains fallback-secret', () => {
const result = validateCriticalEnv(
validEnv({ AUTH_SECRET: 'this-is-a-long-fallback-secret-string-32chars!' })
);
expect(result.valid).toBe(false);
expect(result.errors[0]).toMatch(
/AUTH_SECRET environment variable must be set to a secure value/
);
});
});

describe('validateCriticalEnv — ENCRYPTION_KEY errors', () => {
Expand Down Expand Up @@ -144,6 +162,12 @@ describe('assertCriticalEnv — throws on bad config', () => {
expect(() => assertCriticalEnv(validEnv({ AUTH_SECRET: undefined }))).toThrow(/AUTH_SECRET/);
});

it('throws when AUTH_SECRET is set to fallback-secret', () => {
expect(() => assertCriticalEnv(validEnv({ AUTH_SECRET: 'fallback-secret' }))).toThrow(
/AUTH_SECRET environment variable must be set to a secure value/
);
});

it('throws when ENCRYPTION_KEY is missing', () => {
expect(() => assertCriticalEnv(validEnv({ ENCRYPTION_KEY: undefined }))).toThrow(
/ENCRYPTION_KEY/
Expand Down
12 changes: 12 additions & 0 deletions lib/validate-env.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,12 @@ export function validateCriticalEnv(env: NodeJS.ProcessEnv = process.env): EnvVa
'Generate one with: openssl rand -base64 32 ' +
'and add it to your .env.local and deployment environment.'
);
} else if (
authSecret === 'fallback-secret' ||
authSecret.toLowerCase().includes('fallback-secret') ||
['secret', 'changeme', 'change-me', 'default-secret'].includes(authSecret.toLowerCase())
) {
errors.push('AUTH_SECRET environment variable must be set to a secure value');
} else if (authSecret.length < 32) {
errors.push(
`AUTH_SECRET is too short (${authSecret.length} chars). ` +
Expand All @@ -50,6 +56,12 @@ export function validateCriticalEnv(env: NodeJS.ProcessEnv = process.env): EnvVa
'Generate one with: openssl rand -hex 32 ' +
'and add it to your .env.local and deployment environment.'
);
} else if (
encryptionKey === 'fallback-secret' ||
encryptionKey.toLowerCase().includes('fallback-secret') ||
['secret', 'changeme', 'change-me', 'default-secret'].includes(encryptionKey.toLowerCase())
) {
errors.push('ENCRYPTION_KEY environment variable must be set to a secure value');
} else if (encryptionKey.length < 32) {
errors.push(
`ENCRYPTION_KEY is too short (${encryptionKey.length} chars). ` +
Expand Down
Loading