apunkt/mike
1
0
Fork 0
mirror of https://github.com/willchen96/mike.git synced 2026-06-14 20:55:13 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #21 from Metbcy/fix/download-secret-fail-fast

Browse source 
fix(security): fail fast when download HMAC secret is missing (closes #7)
This commit is contained in:
cosimoastrada 2026-05-11 02:20:27 +08:00 • committed by GitHub
commit 0ac2744a8e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 14 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

13
backend/src/lib/downloadTokens.ts
View file

@ -10,11 +10,16 @@ import crypto from "crypto";
*/
function getSecret(): string {
return (
const secret =
process.env.DOWNLOAD_SIGNING_SECRET ??
process.env.SUPABASE_SECRET_KEY ??
"dev-secret"
);
process.env.SUPABASE_SECRET_KEY;
if (!secret) {
throw new Error(
"DOWNLOAD_SIGNING_SECRET (or SUPABASE_SECRET_KEY as a fallback) must be set. " +
"Generate a strong random value (e.g. `openssl rand -hex 32`) and set it in the environment.",
);
}
return secret;
}
function b64urlEncode(buf: Buffer): string {