Hacktoberfest 2026: as issues que os mantenedores marcaram para outubro, abertas e boas para iniciantes. Ver issues do Hacktoberfest

Add startup checks that catch weak or leaked security settings

Aberta
  • Algo errado?
#231 3 comentários 0 reações 1 responsável Ver no GitHub

Mantenedores costumam responder em até 1 dia

@varun-pahuja já está trabalhando nisso.

Desde 20/10/2026.

Avaliação

Esta issue ainda não foi avaliada.

Descrição

enhancement good first issue hacktoberfest server

The next release adds security settings to the server: a list of allowed origins and secrets for signing session tokens. The easy mistakes there are silent, like a 10 character secret, a secret that's also in a NEXT_PUBLIC_ variable (so it ships to every browser), or an allowed origin typed as acme.com with no https://. This issue adds one function that finds those mistakes, in a new file, so the server can print them at startup later.

What to do
Create packages/server/src/security/startup-checks.ts:

export interface SecuritySettings {
  allowedOrigins?: string[];
  sessionSecrets?: string[];
}

export interface SecurityProblem {
  level: 'error' | 'warning';
  message: string;
}

export function checkSecuritySettings(
  settings: SecuritySettings,
  env?: Record<string, string | undefined>
): SecurityProblem[];

Report these:

  • error: a session secret shorter than 32 bytes (count UTF-8 bytes, not characters)
  • error: a session secret that's also the value of an env variable starting with NEXT_PUBLIC_, VITE_, PUBLIC_, NUXT_PUBLIC_, EXPO_PUBLIC_ or REACT_APP_. Name the variable in the message, but never put the secret itself in a message
  • warning: two session secrets that are the same
  • error: an allowed origin that isn't * and doesn't start with http:// or https://
  • error: an allowed origin with a path, query or trailing slash (https://acme.com/), since browsers send the origin without one
  • warning: http:// origins other than localhost or 127.0.0.1
  • warning: * together with other entries (the others do nothing)

env defaults to globalThis.process?.env, so it also works where process doesn't exist (Workers).

Where to look

  • packages/server/src/handler.ts, line 16, for how the server words its startup warnings today

Acceptance criteria

  • New packages/server/src/security/startup-checks.ts and packages/server/tests/security/startup-checks.test.ts
  • One test per rule, plus a clean config that returns []
  • A test proves the secret value is not in any message
  • Not exported from @chatcops/server yet, and no changeset needed (pnpm changeset --empty)
  • pnpm test:coverage and pnpm lint pass

Want to work on this? Comment below and I'll assign it to you. Please take one issue at a time, branch off dev, and open your PR against dev with Closes #<this issue number>. Setup notes (pnpm, build before test) are in CONTRIBUTING.md.

Linguagem predominante
TypeScript
Estrelas
13
Forks
7
Merge médio
4h 11min
PRs com merge (30d)
122

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de codercops/chatcops

Todas as issues de codercops/chatcops

Issues semelhantes

Mais issues de TypeScript

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.