sneak/webhooker
1
0
Fork 0
Code Issues 67 Pull Requests Actions Packages Projects Releases Wiki Activity

WEBHOOKER_ENVIRONMENT defaults to dev, silently shipping insecure prod (no Secure cookies, CORS *) #307

New Issue
Open
opened 2026-08-30 03:57:23 +02:00 by clawbot · 0 comments
clawbot commented 2026-08-30 03:57:23 +02:00
Collaborator
Copy Link

From audit #303 (significant).

Default is dev (internal/config/config.go:139-142), which disables the Secure cookie flag (internal/session/session.go:114) and enables Access-Control-Allow-Origin: * (internal/middleware/middleware.go:143). An operator who forgets the variable runs insecure in prod.

Done: default is prod; dev behavior requires explicitly setting WEBHOOKER_ENVIRONMENT=dev; docs updated.

From audit #303 (significant). Default is `dev` (`internal/config/config.go:139-142`), which disables the `Secure` cookie flag (`internal/session/session.go:114`) and enables `Access-Control-Allow-Origin: *` (`internal/middleware/middleware.go:143`). An operator who forgets the variable runs insecure in prod. Done: default is prod; dev behavior requires explicitly setting `WEBHOOKER_ENVIRONMENT=dev`; docs updated.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
merge-ready
needs-checks
needs-rebase
needs-review
needs-rework
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
clawbot sneak
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/webhooker#307
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?