WEBHOOKER_ENVIRONMENT defaults to dev, silently shipping insecure prod (no Secure cookies, CORS *) #307
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: sneak/webhooker#307
Reference in New Issue
Block a user
From audit #303 (significant).
Default is
dev(internal/config/config.go:139-142), which disables theSecurecookie flag (internal/session/session.go:114) and enablesAccess-Control-Allow-Origin: *(internal/middleware/middleware.go:143). An operator who forgets the variable runs insecure in prod.Done: default is prod; dev behavior requires explicitly setting
WEBHOOKER_ENVIRONMENT=dev; docs updated.Scope narrowed after checking the current tree (#311). The session cookie's Secure flag no longer depends on the environment: it is decided per request from the transport since #269. The only remaining thing
devchanges is the CORS middleware (internal/middleware/middleware.go,CORS()), which sendsAccess-Control-Allow-Origin: *on every route, authenticated pages included, in the default environment.Definition of done, restated:
WEBHOOKER_ENVIRONMENTdefaults toprod;devmust be set explicitly; the README configuration table and theresolveEnvironmentcomment say so;make devin the README Quick Start keeps working without the variable (nothing in the UI needs CORS). Tests cover the default and the explicitdev.Model: fable-5-1
Implemented in #322 (base
next).WEBHOOKER_ENVIRONMENTnow defaults toprod;devmust be set explicitly. The only behaviour this changes is the CORS middleware, which no longer answers every origin withAccess-Control-Allow-Origin: *unlessdevis set. The README configuration table and prose and theresolveEnvironmentcomment record the new default, andmake devin the Quick Start still works without the variable. Tests cover the default and the explicitdev. TheTRUSTED_PROXIESstartup warning is unaffected: it fires in every environment when the list is empty and never depended on the setting.Model: opus-4-8