Skip to content
This repository has been archived by the owner on Mar 22, 2021. It is now read-only.

Crash if token_secret_signature_key returns empty string #257

Open
Kukunin opened this issue Mar 17, 2020 · 1 comment · May be fixed by #261
Open

Crash if token_secret_signature_key returns empty string #257

Kukunin opened this issue Mar 17, 2020 · 1 comment · May be fixed by #261

Comments

@Kukunin
Copy link

Kukunin commented Mar 17, 2020

The problem happened with a fork of knock which I was using for a long time: https://github.com/JonaMX/knock.

It worked well until I decided to upgrade to the newer fork of knock - this repository. I noticed that previous tokens stopped work and I started to dig.

It turned out, that in that fork, the author replaced to self.token_secret_signature_key = -> { Rails.application.credentials.read }, which returns an empty string "" for my Rails 5.2.

So I have been running the application for years with no secret signature key. Of course, it's my responsibility.

What I suggest is to add a check somewhere in the code so other potential users couldn't shoot in the foot again. Something like

raise "Knock secret signature key can't be empty" if Knock.token_secret_signature_key.call.blank?
@andrerpbts
Copy link
Collaborator

Similar to #212

There's an open PR that we started a discussion about it: #225

Feel free to contribute there, with suggestions or opening a new PR considering the points raised there...

Thanks!

@renatamarques97 renatamarques97 linked a pull request May 24, 2020 that will close this issue
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants