Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

Add startup checks that catch weak or leaked security settings

未关闭
  • 哪里不对？
#231 3 条评论 0 个 reaction 已指派 1 人 在 GitHub 查看

维护者通常 1 天内回复

@varun-pahuja 已经在做这个了。

开始于 2026年10月20日。

评估

这个 Issue 还没有评估数据。

描述

enhancement good first issue hacktoberfest server

The next release adds security settings to the server: a list of allowed origins and secrets for signing session tokens. The easy mistakes there are silent, like a 10 character secret, a secret that's also in a NEXT_PUBLIC_ variable (so it ships to every browser), or an allowed origin typed as acme.com with no https://. This issue adds one function that finds those mistakes, in a new file, so the server can print them at startup later.

What to do
Create packages/server/src/security/startup-checks.ts:

export interface SecuritySettings {
  allowedOrigins?: string[];
  sessionSecrets?: string[];
}

export interface SecurityProblem {
  level: 'error' | 'warning';
  message: string;
}

export function checkSecuritySettings(
  settings: SecuritySettings,
  env?: Record<string, string | undefined>
): SecurityProblem[];

Report these:

  • error: a session secret shorter than 32 bytes (count UTF-8 bytes, not characters)
  • error: a session secret that's also the value of an env variable starting with NEXT_PUBLIC_, VITE_, PUBLIC_, NUXT_PUBLIC_, EXPO_PUBLIC_ or REACT_APP_. Name the variable in the message, but never put the secret itself in a message
  • warning: two session secrets that are the same
  • error: an allowed origin that isn't * and doesn't start with http:// or https://
  • error: an allowed origin with a path, query or trailing slash (https://acme.com/), since browsers send the origin without one
  • warning: http:// origins other than localhost or 127.0.0.1
  • warning: * together with other entries (the others do nothing)

env defaults to globalThis.process?.env, so it also works where process doesn't exist (Workers).

Where to look

  • packages/server/src/handler.ts, line 16, for how the server words its startup warnings today

Acceptance criteria

  • New packages/server/src/security/startup-checks.ts and packages/server/tests/security/startup-checks.test.ts
  • One test per rule, plus a clean config that returns []
  • A test proves the secret value is not in any message
  • Not exported from @chatcops/server yet, and no changeset needed (pnpm changeset --empty)
  • pnpm test:coverage and pnpm lint pass

Want to work on this? Comment below and I'll assign it to you. Please take one issue at a time, branch off dev, and open your PR against dev with Closes #<this issue number>. Setup notes (pnpm, build before test) are in CONTRIBUTING.md.

主要语言
TypeScript
星标
13
派生
7
平均合并
3 小时 33 分钟
30 天内合并 PR
176

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

codercops/chatcops 的其他 Issue

查看 codercops/chatcops 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。