fix(chatbot): fail loudly on a weak or missing AUTH_SECRET - #644
Open
harrymove-ctrl wants to merge 1 commit into
Open
fix(chatbot): fail loudly on a weak or missing AUTH_SECRET#644harrymove-ctrl wants to merge 1 commit into
harrymove-ctrl wants to merge 1 commit into
Conversation
NextAuth silently accepts any AUTH_SECRET value, including an unset or short one, and just signs session/guest JWTs with it. Staging currently has an 8-character AUTH_SECRET on chatbot-frontend — same weak value as researcher-frontend, which is caught and rejected by its own getSecret() guard (enoki-challenge.ts). Chatbot had no equivalent check, so the weak secret degrades security silently instead of surfacing an error. Adds getAuthSecret() (apps/chatbot/lib/auth-secret.ts), mirroring researcher's >=32-char validation, and wires it into the three places that read AUTH_SECRET directly: auth.ts, guest/route.ts, proxy.ts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
researcher-demo-staging, found the root cause: staging'sresearcher-frontendhas anAUTH_SECRETthat's only 8 characters long.apps/researcher/lib/auth/enoki-challenge.tscorrectly rejects it (AUTH_SECRET must contain at least 32 characters), which is what surfaces as the generic "Unable to verify wallet ownership" error in the UI.noter-frontend— not affected. Its Enoki challenge flow (apps/noter/package/feature/auth/lib/enoki-challenge.ts) is stateless via Redis nonces, noAUTH_SECRETdependency at all.chatbot-frontend— has the same 8-characterAUTH_SECRETvalue as researcher-frontend, but nothing validates it, so NextAuth just signs session/guest JWTs with a short HS256 key instead of erroring. Silent security weakness, not a visible bug — which is why it hadn't been caught.getAuthSecret()(mirrors researcher's existing guard) throws ifAUTH_SECRETis unset or under 32 chars, wired into the three places chatbot reads it directly (auth.ts,guest/route.ts,proxy.ts).Not included here (needs a separate ops action, not code)
The actual staging secrets still need to be rotated to real random values on Railway (in progress, separately — not via this PR):
researcher-frontend(staging): currently broken (Enoki login 500s) until rotatedchatbot-frontend(staging): currently "working" but weakly signed until rotatedBoth are runtime config changes, not something this PR touches — flagging for a follow-up once this merges, so chatbot starts failing loudly the same way researcher already does if it's ever deployed with a weak value again.
Test plan
AUTH_SECRETAUTH_SECRETis unset or short, e.g. locally withAUTH_SECRET=short pnpm --filter chatbot dev