nizar/server-master
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Harden auth/env config: fix health API key check and remove insecure defaults

Browse source
This commit is contained in:
nizar 2026-02-23 23:32:05 +01:00
parent 2c6320512f
commit 376a8fcbd8
4 changed files with 12 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
srcs/GameChannel/Controllers/HealthController.cs
View file

@ -65,7 +65,7 @@ namespace GameChannel.Controllers
public class HealthCheckApiKey : Attribute, IAsyncActionFilter
{
private const string APIKEYNAME = "HEALTHCHECK_API_KEY";
private static string HEALTHCHECK_API_KEY = Environment.GetEnvironmentVariable(APIKEYNAME) ?? "123456789";
private static readonly string HEALTHCHECK_API_KEY = Environment.GetEnvironmentVariable(APIKEYNAME);
public async Task OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next)
{
@ -79,7 +79,7 @@ namespace GameChannel.Controllers
return;
}
if (!extractedApiKey.Equals(extractedApiKey))
if (string.IsNullOrWhiteSpace(HEALTHCHECK_API_KEY) || !string.Equals(extractedApiKey.ToString(), HEALTHCHECK_API_KEY, StringComparison.Ordinal))
{
context.Result = new ContentResult
{

8
srcs/PhoenixLib.Auth.JWT/DependencyInjectionExtensions.cs
View file

@ -8,7 +8,13 @@ namespace PhoenixLib.Auth.JWT
{
public static void AddJwtFactoryFromEnv(this IServiceCollection services)
{
services.TryAddSingleton<IJwtTokenFactory>(new JwtTokenFactory(Environment.GetEnvironmentVariable("JWT_PRIVATE_KEY")));
string jwtPrivateKey = Environment.GetEnvironmentVariable("JWT_PRIVATE_KEY");
if (string.IsNullOrWhiteSpace(jwtPrivateKey))
{
throw new InvalidOperationException("JWT_PRIVATE_KEY environment variable is required");
}
services.TryAddSingleton<IJwtTokenFactory>(new JwtTokenFactory(jwtPrivateKey));
}
}
}

2
srcs/PhoenixLib.DAL.EFCore.PGSQL/PgSqlDatabaseConfiguration.cs
View file

@ -29,7 +29,7 @@ namespace PhoenixLib.DAL.EFCore.PGSQL
string ip = Environment.GetEnvironmentVariable("POSTGRES_DATABASE_IP") ?? "localhost";
string username = Environment.GetEnvironmentVariable("POSTGRES_DATABASE_USER") ?? "postgres";
string password = Environment.GetEnvironmentVariable("POSTGRES_DATABASE_PASSWORD") ?? "postgres";
string database = Environment.GetEnvironmentVariable("POSTGRES_DATABASE_NAME") ?? "posgtres";
string database = Environment.GetEnvironmentVariable("POSTGRES_DATABASE_NAME") ?? "postgres";
if (!ushort.TryParse(Environment.GetEnvironmentVariable("POSTGRES_DATABASE_PORT") ?? "5432", out ushort port))
{
port = 5432;

3
srcs/_plugins/Plugin.DB.EF/DB/DatabaseConfiguration.cs
View file

@ -12,7 +12,8 @@ namespace Plugin.Database.DB
{
Ip = Environment.GetEnvironmentVariable("DATABASE_IP") ?? "localhost";
Username = Environment.GetEnvironmentVariable("DATABASE_USER") ?? "postgres";
Password = Environment.GetEnvironmentVariable("DATABASE_PASSWORD") ?? "VaNOSilla2022";
Password = Environment.GetEnvironmentVariable("DATABASE_PASSWORD")
?? throw new InvalidOperationException("DATABASE_PASSWORD environment variable is required");
Database = Environment.GetEnvironmentVariable("DATABASE_NAME") ?? "game";
WriteBufferSize = Convert.ToInt32(Environment.GetEnvironmentVariable("DATABASE_WRITE_BUFFER_SIZE") ?? "8192");
ReadBufferSize = Convert.ToInt32(Environment.GetEnvironmentVariable("DATABASE_READ_BUFFER_SIZE") ?? "8192");