Mike Gerwitz

Activist for User Freedom

path: root/conf
diff options
authorMike Gerwitz <mike.gerwitz@rtspecialty.com>2018-04-03 15:06:49 -0400
committerMike Gerwitz <mike.gerwitz@rtspecialty.com>2018-04-03 15:29:47 -0400
commit6733556582355f9c884c3e5099e272eeca5d49d7 (patch)
treeb85a477a2260b93d5ad4fce71a47fe1a44da8398 /conf
parent460a5337778ee05112594cbb7dea5fbc9e24d754 (diff)
Remove hard-coded skey
This wasn't intended to make its way into a public repo. :) The existing key was a long-forgotten kluge that was supposed to be temporary, allowing internal services to create quotes without authentication. The chances of this being practically exploited are minimal in our environment, and it's auditable using webserver logs. This moves the skey into a configuration file, which allows it to vary by server and be rotated until a better solution is made available. skey is disabled by default (empty string), and when used by us internally, the keys are now generated using a CSPRNG rather than a brute-forcable 5-byte key that was hard-coded. The fact that this appears in webserver logs is a big issue as well. I added a task to address that. * conf/vanilla-server.json (skey): New key. Default empty. * src/server/daemon/Daemon.js (start): Provide skey to `#getRouters'. (getRouters): Provide skey to `#getProgramController'. (getProgramController): Set skey on `controller'. * src/server/daemon/controller.js (skey): New mutable export (unideal; quick change). (has_skey): Use it.
Diffstat (limited to 'conf')
1 files changed, 2 insertions, 0 deletions
diff --git a/conf/vanilla-server.json b/conf/vanilla-server.json
index 5e5da12..41e90b8 100644
--- a/conf/vanilla-server.json
+++ b/conf/vanilla-server.json
@@ -18,6 +18,8 @@
+ "skey": "",
"user": {
"session": {
"handler": {