37f7f62157
Seven security issues from an audit, plus album pages and the map coming up empty against Immich 3.x. Verified against a real Immich 3.0.3 instance in a production build. Security: - Admin session forgery via a hardcoded 'dev-fallback-secret' signing key that bypassed the production AUTH_SECRET guard - /api/map ignored album passwords and returned working asset tokens; rewriting ?size=thumbnail to ?size=original downloaded full-resolution originals from protected albums - Admin login had no rate limit, and the client IP came from a spoofable header, so rotating it bypassed every limit in the app - Raw Immich asset UUIDs were serialized into the RSC payload - Album tokens never expired server-side; a captured token replayed forever - Path traversal into the Immich API via an unvalidated album id - /admin ran with no enforced CSP (only Report-Only reached it) TRUSTED_PROXIES is replaced by TRUSTED_PROXY_HOPS. The old variable matched proxy IPs against the socket peer address, which self-hosted Next.js never exposes, so the check could never pass: unset, the limiter read a spoofable header; set, every request shared one bucket and a single client could rate-limit the whole site. Migrates automatically. Immich 3.x: GET /albums/:id no longer embeds assets. Assets now come from POST /search/metadata with withExif: true — without that flag EXIF is omitted and grid aspect ratios, the lightbox panel and map markers stay empty. Drops support for Immich below 3.0, which now logs a warning. Upgrade: requires Immich 3.0+; set TRUSTED_PROXY_HOPS (nginx = 1); visitors of protected areas and admin sessions must log in once more. 91 unit tests (25 new); the new admin-auth and rate-limit cases were confirmed to fail against the pre-fix code. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
36 lines
1.1 KiB
TypeScript
36 lines
1.1 KiB
TypeScript
/**
|
||
* Single source of truth for AUTH_SECRET resolution.
|
||
*
|
||
* Fails closed in production: a missing AUTH_SECRET throws rather than falling
|
||
* back to a guessable constant. In development an ephemeral per-process secret
|
||
* is generated instead, so sessions simply do not survive a restart.
|
||
*/
|
||
|
||
import crypto from 'crypto';
|
||
import { env } from './env';
|
||
|
||
let _fallbackSecret: string | null = null;
|
||
let _warned = false;
|
||
|
||
export function resolveAuthSecret(): string {
|
||
const secret = env.AUTH_SECRET;
|
||
if (secret) return secret;
|
||
|
||
if (process.env.NODE_ENV === 'production') {
|
||
throw new Error(
|
||
'SECURITY ERROR: AUTH_SECRET is not set in production. Please set a long random string as AUTH_SECRET in your .env.',
|
||
);
|
||
}
|
||
|
||
if (!_fallbackSecret) {
|
||
_fallbackSecret = crypto.randomBytes(32).toString('hex');
|
||
}
|
||
if (!_warned) {
|
||
console.warn(
|
||
'\n⚠️ SECURITY WARNING: AUTH_SECRET is not set. Generating a temporary random secret for this session.\n Please set a long random string as AUTH_SECRET in your .env for better security.\n',
|
||
);
|
||
_warned = true;
|
||
}
|
||
return _fallbackSecret;
|
||
}
|