apunkt/mike
1
0
Fork 0
mirror of https://github.com/willchen96/mike.git synced 2026-06-08 20:25:13 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #21 from Metbcy/fix/download-secret-fail-fast

Browse source 
fix(security): fail fast when download HMAC secret is missing (closes #7)
This commit is contained in:
cosimoastrada 2026-05-11 02:20:27 +08:00 • committed by GitHub
commit 0ac2744a8e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 14 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

5
backend/.env.example
View file

@ -1,5 +1,10 @@
PORT=3001
FRONTEND_URL=http://localhost:3000
# HMAC key used to sign /download/:token URLs. Required at startup.
# Generate with: openssl rand -hex 32
# Use a dedicated secret distinct from SUPABASE_SECRET_KEY.
DOWNLOAD_SIGNING_SECRET=replace-with-a-random-32-byte-hex-string
SUPABASE_URL=https://your-project.supabase.co
SUPABASE_SECRET_KEY=your-supabase-service-role-key

13
backend/src/lib/downloadTokens.ts
View file

@ -10,11 +10,16 @@ import crypto from "crypto";
*/
function getSecret(): string {
return (
const secret =
process.env.DOWNLOAD_SIGNING_SECRET ??
process.env.SUPABASE_SECRET_KEY ??
"dev-secret"
);
process.env.SUPABASE_SECRET_KEY;
if (!secret) {
throw new Error(
"DOWNLOAD_SIGNING_SECRET (or SUPABASE_SECRET_KEY as a fallback) must be set. " +
"Generate a strong random value (e.g. `openssl rand -hex 32`) and set it in the environment.",
);
}
return secret;
}
function b64urlEncode(buf: Buffer): string {