Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Add startup checks that catch weak or leaked security settings

Aperta
  • Qualcosa non va?
#231 3 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@varun-pahuja ci sta già lavorando.

Dal 20/10/2026.

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

enhancement good first issue hacktoberfest server

The next release adds security settings to the server: a list of allowed origins and secrets for signing session tokens. The easy mistakes there are silent, like a 10 character secret, a secret that's also in a NEXT_PUBLIC_ variable (so it ships to every browser), or an allowed origin typed as acme.com with no https://. This issue adds one function that finds those mistakes, in a new file, so the server can print them at startup later.

What to do
Create packages/server/src/security/startup-checks.ts:

export interface SecuritySettings {
  allowedOrigins?: string[];
  sessionSecrets?: string[];
}

export interface SecurityProblem {
  level: 'error' | 'warning';
  message: string;
}

export function checkSecuritySettings(
  settings: SecuritySettings,
  env?: Record<string, string | undefined>
): SecurityProblem[];

Report these:

  • error: a session secret shorter than 32 bytes (count UTF-8 bytes, not characters)
  • error: a session secret that's also the value of an env variable starting with NEXT_PUBLIC_, VITE_, PUBLIC_, NUXT_PUBLIC_, EXPO_PUBLIC_ or REACT_APP_. Name the variable in the message, but never put the secret itself in a message
  • warning: two session secrets that are the same
  • error: an allowed origin that isn't * and doesn't start with http:// or https://
  • error: an allowed origin with a path, query or trailing slash (https://acme.com/), since browsers send the origin without one
  • warning: http:// origins other than localhost or 127.0.0.1
  • warning: * together with other entries (the others do nothing)

env defaults to globalThis.process?.env, so it also works where process doesn't exist (Workers).

Where to look

  • packages/server/src/handler.ts, line 16, for how the server words its startup warnings today

Acceptance criteria

  • New packages/server/src/security/startup-checks.ts and packages/server/tests/security/startup-checks.test.ts
  • One test per rule, plus a clean config that returns []
  • A test proves the secret value is not in any message
  • Not exported from @chatcops/server yet, and no changeset needed (pnpm changeset --empty)
  • pnpm test:coverage and pnpm lint pass

Want to work on this? Comment below and I'll assign it to you. Please take one issue at a time, branch off dev, and open your PR against dev with Closes #<this issue number>. Setup notes (pnpm, build before test) are in CONTRIBUTING.md.

Lingua principale
TypeScript
Stelle
13
Fork
7
Merge medio
3h 41m
PR unite (30g)
155

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di codercops/chatcops

Tutte le issue di codercops/chatcops

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.