summaryrefslogtreecommitdiff
path: root/lib
diff options
context:
space:
mode:
authorSheogorath2018-03-26 00:30:17 +0200
committerSheogorath2018-03-26 00:36:28 +0200
commit3599fb79b437fb758e799452a9ad335420787349 (patch)
tree96ef2cc7d5fd86b1b43d65fb87f496673cad0664 /lib
parent57c47a65dde59d355fba702bc91c63eebcc2533c (diff)
Automatically generate a session secret if default is used
The session secret is used to sign and authenticate the session cookie and this way very important for the authentication process. By default the session secret is set to `secret` and never changes. This commit will add a generator for a dynamic session secret if it stays unchanged. It prevents session hijacking this way and will warn the user about the missing secret. This also implies that on a restart without configured session secret will log out all users. While it may seems annoying, it's for the users best. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
Diffstat (limited to '')
-rw-r--r--lib/config/default.js1
-rw-r--r--lib/config/index.js9
2 files changed, 10 insertions, 0 deletions
diff --git a/lib/config/default.js b/lib/config/default.js
index 19ddccf6..b6f1af17 100644
--- a/lib/config/default.js
+++ b/lib/config/default.js
@@ -46,6 +46,7 @@ module.exports = {
// session
sessionName: 'connect.sid',
sessionSecret: 'secret',
+ sessionSecretLen: 128,
sessionLife: 14 * 24 * 60 * 60 * 1000, // 14 days
staticCacheTime: 1 * 24 * 60 * 60 * 1000, // 1 day
// socket.io
diff --git a/lib/config/index.js b/lib/config/index.js
index fae51e52..54e9aae6 100644
--- a/lib/config/index.js
+++ b/lib/config/index.js
@@ -1,6 +1,7 @@
'use strict'
+const crypto = require('crypto')
const fs = require('fs')
const path = require('path')
const {merge} = require('lodash')
@@ -117,6 +118,14 @@ for (let i = keys.length; i--;) {
}
}
+// Generate session secret if it stays on default values
+if (config.sessionSecret === 'secret') {
+ logger.warn('Session secret not set. Using random generated one. Please set `sessionSecret` in your config.js file. All users will be logged out.')
+ config.sessionSecret = crypto.randomBytes(Math.ceil(config.sessionSecretLen / 2)) // generate crypto graphic random number
+ .toString('hex') // convert to hexadecimal format
+ .slice(0, config.sessionSecretLen) // return required number of characters
+}
+
// Validate upload upload providers
if (['filesystem', 's3', 'minio', 'imgur'].indexOf(config.imageUploadType) === -1) {
logger.error('"imageuploadtype" is not correctly set. Please use "filesystem", "s3", "minio" or "imgur". Defaulting to "imgur"')