WEBHOOKER_ENVIRONMENT defaults to dev, silently shipping insecure prod (no Secure cookies, CORS *) #307

New Issue

2026-08-30T03:57:23+02:00

clawbot commented

2026-08-30 03:57:23 +02:00

From audit #303 (significant).

Default is dev (internal/config/config.go:139-142), which disables the Secure cookie flag (internal/session/session.go:114) and enables Access-Control-Allow-Origin: * (internal/middleware/middleware.go:143). An operator who forgets the variable runs insecure in prod.

Done: default is prod; dev behavior requires explicitly setting WEBHOOKER_ENVIRONMENT=dev; docs updated.

From audit #303 (significant). Default is `dev` (`internal/config/config.go:139-142`), which disables the `Secure` cookie flag (`internal/session/session.go:114`) and enables `Access-Control-Allow-Origin: *` (`internal/middleware/middleware.go:143`). An operator who forgets the variable runs insecure in prod. Done: default is prod; dev behavior requires explicitly setting `WEBHOOKER_ENVIRONMENT=dev`; docs updated.

clawbot referenced this issue

2026-08-30 03:57:42 +02:00

Independent code audit #303

clawbot referenced this issue

2026-09-21 09:19:47 +02:00

Review toward 1.0: identify and file all next steps #311

clawbot commented

2026-09-21 09:20:32 +02:00

Scope narrowed after checking the current tree (#311). The session cookie's Secure flag no longer depends on the environment: it is decided per request from the transport since #269. The only remaining thing dev changes is the CORS middleware (internal/middleware/middleware.go, CORS()), which sends Access-Control-Allow-Origin: * on every route, authenticated pages included, in the default environment.

Definition of done, restated: WEBHOOKER_ENVIRONMENT defaults to prod; dev must be set explicitly; the README configuration table and the resolveEnvironment comment say so; make dev in the README Quick Start keeps working without the variable (nothing in the UI needs CORS). Tests cover the default and the explicit dev.

Model: fable-5-1

Scope narrowed after checking the current tree (https://git.eeqj.de/sneak/webhooker/issues/311). The session cookie's Secure flag no longer depends on the environment: it is decided per request from the transport since https://git.eeqj.de/sneak/webhooker/issues/269. The only remaining thing `dev` changes is the CORS middleware (`internal/middleware/middleware.go`, `CORS()`), which sends `Access-Control-Allow-Origin: *` on every route, authenticated pages included, in the default environment. Definition of done, restated: `WEBHOOKER_ENVIRONMENT` defaults to `prod`; `dev` must be set explicitly; the README configuration table and the `resolveEnvironment` comment say so; `make dev` in the README Quick Start keeps working without the variable (nothing in the UI needs CORS). Tests cover the default and the explicit `dev`. Model: fable-5-1

clawbot added this to the 1.0.0 milestone 2026-09-21 09:20:32 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/webhooker#307