gsadmin/KoalaSync
1
0
Fork 0
mirror of https://github.com/Shik3i/KoalaSync.git synced 2026-07-26 12:08:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

security(server): warn at startup when SERVER_SALT is unset

Browse Source 
Room-password hashing falls back to a built-in salt that is public in the repo
when SERVER_SALT is not configured. Low risk (the hash never leaves the server),
but operators should set a unique salt — warn at startup, mirroring the existing
ADMIN_METRICS_TOKEN warning.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
KoalaDev
2026-06-28 02:37:37 +02:00
parent dfa0a3d03e
commit 9626948f29
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/index.js
+4
View File
@@ -64,6 +64,10 @@ if (!isAdminMetricsTokenStrong(ADMIN_METRICS_TOKEN)) {
console.warn('[SECURITY] ADMIN_METRICS_TOKEN is set but shorter than 32 characters. Use a long random token.');
}
if (!process.env.SERVER_SALT) {
console.warn('[SECURITY] SERVER_SALT is not set — using the built-in default salt (public in the repo). Set a unique SERVER_SALT so room-password hashes are not computed with a known salt.');
}
export const app = express();
app.set('trust proxy', 1); // For real client IP through reverse proxy