olaf/Link-Log
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

Secret test at startup
Build LinkLog Development Image / development-image (push) Successful in 11s
Details

Browse Source
This commit is contained in:
olaf
2026-08-26 20:54:00 +02:00
parent 04b8a5a8b9
commit ffb12a36b5
7 changed files with 64 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Security-audit.md
+8 -4
View File
@@ -90,14 +90,18 @@ The application should remain behind the production reverse proxy, with real DNS
### SA-005: Production secret fallback is not fail-closed
**Severity:** Medium
**Evidence:** `Settings.secret_key` defaults to `dev-secret-key-change-me`, and `LINKLOG_DATA_ENCRYPTION_KEY` is validated when encryption is used rather than fully validated during startup.
**Severity:** Medium, remediated in current worktree
**Evidence before remediation:** `Settings.secret_key` defaulted to `dev-secret-key-change-me`, and `LINKLOG_DATA_ENCRYPTION_KEY` was validated when encryption was used rather than fully validated during startup.
**Impact:** A deployment that omits required configuration can start with a known development secret or fail only when a protected feature is exercised. This creates dangerous configuration drift and complicates incident response.
**Recommendation:** During startup, reject a missing or known development `LINKLOG_SECRET_KEY` when `APP_ENV=production`; validate minimum length and entropy. Require and validate the encryption key before startup when encrypted data exists or production requires it. Add configuration tests for fail-closed production behavior.
**Current state:** `validate_configuration()` runs before FastAPI app construction. In production it rejects a missing or known development `LINKLOG_SECRET_KEY`, application secrets shorter than 32 characters or with insufficient character diversity, and missing `LINKLOG_DATA_ENCRYPTION_KEY`. Any supplied encryption key is checked as a valid Fernet key. Focused tests cover rejection and acceptance paths.
**Priority:** Medium.
**Residual impact:** Secret strength checks are pragmatic length/diversity checks rather than a full entropy estimator. Secret provisioning, rotation, and protected storage remain operational requirements.
**Recommendation:** Keep production startup fail-closed, provision secrets through a protected secret manager, rotate them after suspected disclosure, and consider a stronger entropy policy if deployment requirements warrant it.
**Priority:** Completed in code; secret provisioning and rotation remain.
### SA-006: Login and reset-mail throttling are not distributed or atomic