security: implement AUTH_SECRET and secure map/exif API routes

2026-03-07 08:18:23 +01:00
parent 2a16a9386f
commit e394fe84a0
14 changed files with 849 additions and 793 deletions
--- a/lib/auth.ts
+++ b/lib/auth.ts
@@ -12,7 +12,7 @@ import { getConfig, SubpageConfig } from './config';
 const TOKEN_EXPIRY_HOURS = 24;

 function hmac(data: string): string {
-  return crypto.createHmac('sha256', getConfig().immich.apiKey).update(data).digest('hex');
+  return crypto.createHmac('sha256', getConfig().authSecret).update(data).digest('hex');
 }

 function authToken(slug: string, password: string): string {