Skip to content

fix: require configured auth cookie secret - #1448

Open
mikemikimike wants to merge 1 commit into
AgentOps-AI:mainfrom
mikemikimike:fix/remove-hardcoded-auth-secret-1446
Open

fix: require configured auth cookie secret#1448
mikemikimike wants to merge 1 commit into
AgentOps-AI:mainfrom
mikemikimike:fix/remove-hardcoded-auth-secret-1446

Conversation

@mikemikimike

Copy link
Copy Markdown

Summary

Fixes #1446.

  • Remove the hardcoded fallback signing key for authentication session cookies.
  • Fail closed when AUTH_COOKIE_SECRET is not configured.
  • Preserve JWT session-cookie signing and verification when a deployment provides a secret.

Testing

  • python -m pytest tests/auth/test_cookie_secret.py tests/auth/test_public_routes.py --confcutdir=tests/auth -q (7 passed, 2 skipped)
  • python -m pytest tests/unit -q (488 passed, 1 skipped)
  • python -m ruff format --check ...
  • python -m ruff check ...
  • git diff --check

The full API suite was also attempted; its ClickHouse fixture failed during migration with an authentication error unrelated to this change.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: Hardcoded fallback signing key for authentication session cookies

1 participant