Description
The backend server starts without checking if critical environment variables are set, silently defaulting to localhost values that may not work in production.
Impact
Missing validation for:
DATABASE_URL — defaults to local SQLite fileREDIS_URL — defaults to redis://localhost:6379SOROBAN_RPC_URL — defaults to Soroban testnetSSL_KEY_PATH / SSL_CERT_PATH — HTTPS silently falls back to HTTP without warningNODE_ENV — defaults to development, may accidentally run dev config in production
Example
In redisService.js:
const REDIS_URL = process.env.REDIS_URL || redis://localhost:6379;
If Redis is not running locally, the service silently falls back to in-memory mode.
Required Fix
- Add a startup validation function that checks required env vars
- Log clear warnings for missing optional vars with their fallback values
- Fail fast if production-required vars are missing
- Consider using a package like
envalid for structured validation
Reference
Identified during full codebase audit of soroban-playground.
Description
The backend server starts without checking if critical environment variables are set, silently defaulting to localhost values that may not work in production.
Impact
Missing validation for:
DATABASE_URL— defaults to local SQLite fileREDIS_URL— defaults toredis://localhost:6379SOROBAN_RPC_URL— defaults to Soroban testnetSSL_KEY_PATH/SSL_CERT_PATH— HTTPS silently falls back to HTTP without warningNODE_ENV— defaults to development, may accidentally run dev config in productionExample
In
redisService.js:If Redis is not running locally, the service silently falls back to in-memory mode.
Required Fix
envalidfor structured validationReference
Identified during full codebase audit of soroban-playground.