From 0c556d98ed54993f888f77b4bc2d7e3a2e18dbad Mon Sep 17 00:00:00 2001 From: Inkcha Date: Mon, 27 Jul 2026 19:30:43 -0400 Subject: [PATCH 1/2] fix: validate SESSION_SECRET in production to prevent fallback-to-insecure The sessionSecret defaulted to a hardcoded dev-only value if SESSION_SECRET env var was not set. In production this means anyone knowing the default can forge session tokens. This change throws a startup error in production if SESSION_SECRET is missing, while preserving the dev fallback for local development. Fixes the HIGH severity issue reported in #88 --- apps/web/lib/env.ts | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/apps/web/lib/env.ts b/apps/web/lib/env.ts index 049ad6c..847dfe5 100644 --- a/apps/web/lib/env.ts +++ b/apps/web/lib/env.ts @@ -19,7 +19,13 @@ export const env = { return this.nodeEnv === "production"; }, sessionSecret: - process.env.SESSION_SECRET || "dev-only-insecure-change-me-0000000000000000", + (() => { + const val = process.env.SESSION_SECRET; + if (!val && process.env.NODE_ENV === "production") { + throw new Error("SESSION_SECRET must be set in production"); + } + return val || "dev-only-insecure-change-me-0000000000000000"; + })(), adminEmails: (process.env.ADMIN_EMAILS || "anthony@profullstack.com") .split(",") .map((e) => e.trim().toLowerCase()) From 543119cc0e86e55cc4760be454a16e87e37738df Mon Sep 17 00:00:00 2001 From: Inkcha Date: Fri, 31 Jul 2026 17:45:26 -0400 Subject: [PATCH 2/2] fix: skip SESSION_SECRET validation during next build phase The previous IIFE threw during 'next build' because CI builds with NODE_ENV=production but no SESSION_SECRET (page-data collection imports env.ts). Now the validation is skipped when NEXT_PHASE equals phase-production-build (Next.js sets this during builds) and still hard-fails at actual production runtime when the secret is missing. --- apps/web/lib/env.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/apps/web/lib/env.ts b/apps/web/lib/env.ts index 847dfe5..a2adb77 100644 --- a/apps/web/lib/env.ts +++ b/apps/web/lib/env.ts @@ -21,7 +21,8 @@ export const env = { sessionSecret: (() => { const val = process.env.SESSION_SECRET; - if (!val && process.env.NODE_ENV === "production") { + const building = process.env.NEXT_PHASE === "phase-production-build"; + if (!val && process.env.NODE_ENV === "production" && !building) { throw new Error("SESSION_SECRET must be set in production"); } return val || "dev-only-insecure-change-me-0000000000000000";