diff options
| author | Adam Soltys <[email protected]> | 2026-08-07 22:59:21 -0700 |
|---|---|---|
| committer | Adam Soltys <[email protected]> | 2026-08-07 23:29:25 -0700 |
| commit | d513ab75131bfaa16b1f0820d0fb18ad9e7f6ab1 (patch) | |
| tree | be028867721f69a1dc102e33b999cd6abdebf522 /config.ts.sample | |
| parent | 9f99bbdb765fc70373943930d543ce1cde7a5f35 (diff) | |
| download | coinos-server-d513ab75131bfaa16b1f0820d0fb18ad9e7f6ab1.tar.gz coinos-server-d513ab75131bfaa16b1f0820d0fb18ad9e7f6ab1.zip | |
auth: fail closed on adminpass, scrub sample secrets (S3)
The master-password path (isAdmin = password === config.adminpass) logs
in as any user, skipping password, 2FA, and captcha. Worse, when
adminpass is unset an omitted password field made undefined === undefined
true, authenticating as anyone. Require both the configured value and the
supplied password to be non-empty and match exactly, across every
adminpass comparison (login, recaptcha bypass, support email, freeze).
Also scrub config.ts.sample: the sample shipped a working-looking JWT
secret, two server nsec keys, and adminpass "pwa". Replace with
fail-closed placeholders and regenerate instructions. Rotate any
deployment that ever shipped the sample values.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Diffstat (limited to 'config.ts.sample')
| -rw-r--r-- | config.ts.sample | 17 |
1 files changed, 13 insertions, 4 deletions
diff --git a/config.ts.sample b/config.ts.sample index 1becf362..80162f5f 100644 --- a/config.ts.sample +++ b/config.ts.sample @@ -12,7 +12,10 @@ export default { "wss://relay.nostr.bg", "wss://nostr.orangepill.dev" ], - jwt: "00d0ab4f7738a83feb37f661526512063c41e49278b7c32cba87314269a5788b", + // SECURITY: generate a fresh 32-byte secret before deploying — + // `openssl rand -hex 32`. This also keys @fastify/secure-session, so a + // published value lets anyone forge session JWTs and read the session cookie. + jwt: "0000000000000000000000000000000000000000000000000000000000000000", bitcoin: { host: "bc", wallet: "coinos", @@ -33,10 +36,16 @@ export default { lightning: "/home/bun/app/data/lightning/regtest/lightning-rpc", lightningb: "/home/bun/app/data/lightningb/regtest/lightning-rpc", fee: 0.001, - adminpass: "pwa", + // SECURITY: the admin login path is disabled when this is empty (fails + // closed). Set a strong, unique value only if you need admin impersonation; + // never ship the sample value. + adminpass: "", support: "[email protected]", - nostrKey: "nsec1msk3dqy2pzqy2murmm5s5gejfgkjkm2zesnh266gud2wcvhcunzqlu0h90", - nostrKey2: "nsec17ugnsk0qrnakf7xaxzckya4xvx58q063k6q4vq2l577k4uyv9r0qmdcgm5", + // SECURITY: generate fresh keys — never deploy these sample values. These are + // the server NWC wallet-service key and the zap-receipt signer. + // node -e "import('nostr-tools').then(n=>console.log(n.nip19.nsecEncode(n.generateSecretKey())))" + nostrKey: "nsec1replacewithafreshlygeneratedkeydonotusethissamplevalue0", + nostrKey2: "nsec1replacewithafreshlygeneratedkeydonotusethissamplevalue1", mintUrl: "http://mint:3338", square: { environment: SquareEnvironment.Sandbox, |