security: implement AUTH_SECRET and secure map/exif API routes

2026-03-07 08:18:23 +01:00
parent 2a16a9386f
commit e394fe84a0
14 changed files with 849 additions and 793 deletions
--- a/lib/tokens.ts
+++ b/lib/tokens.ts
@@ -13,8 +13,8 @@ let _key: Buffer | null = null;

 function getKey(): Buffer {
  if (!_key) {
-    const apiKey = getConfig().immich.apiKey;
-    _key = crypto.createHash('sha256').update(apiKey).digest();
+    const authSecret = getConfig().authSecret;
+    _key = crypto.createHash('sha256').update(authSecret).digest();
  }
  return _key;
 }