mirror of
https://github.com/andwati/dokploy.git
synced 2026-10-23 21:42:19 +00:00
Mauricio Siu
9c71458eff
- Added a new script `migrate-auth-secret.ts` to facilitate the migration of 2FA secrets when changing the BETTER_AUTH_SECRET. - Updated `package.json` to include a command for running the migration script. - Refactored the handling of BETTER_AUTH_SECRET to improve security by removing the hardcoded default and introducing a fallback mechanism using environment variables or Docker secrets. - Updated the authentication logic to utilize the new `betterAuthSecret` function for retrieving the secret.
29 lines
857 B
TypeScript
29 lines
857 B
TypeScript
import { readSecret } from "../db/constants";
|
|
|
|
const HARDCODED_LEGACY_SECRET = "better-auth-secret-123456789";
|
|
|
|
const { BETTER_AUTH_SECRET, BETTER_AUTH_SECRET_FILE } = process.env;
|
|
|
|
function resolveBetterAuthSecret(): string {
|
|
if (BETTER_AUTH_SECRET) {
|
|
return BETTER_AUTH_SECRET;
|
|
}
|
|
if (BETTER_AUTH_SECRET_FILE) {
|
|
return readSecret(BETTER_AUTH_SECRET_FILE);
|
|
}
|
|
if (process.env.NODE_ENV !== "test") {
|
|
console.warn(`
|
|
⚠️ [DEPRECATED AUTH CONFIG]
|
|
BETTER_AUTH_SECRET is not set via environment variable or Docker secret.
|
|
Falling back to the insecure hardcoded default — this is a CRITICAL SECURITY RISK.
|
|
This mode WILL BE REMOVED in a future release.
|
|
|
|
Please migrate to Docker Secrets:
|
|
curl -sSL https://dokploy.com/security/0.29.3.sh | bash
|
|
`);
|
|
}
|
|
return HARDCODED_LEGACY_SECRET;
|
|
}
|
|
|
|
export const betterAuthSecret = resolveBetterAuthSecret();
|