apache / helix

Mirror of Apache Helix
Apache License 2.0
457 stars 218 forks source link

Do not start the server if user uses the default SECRET_TOKEN env value #2783

Closed hivivo closed 4 months ago

hivivo commented 4 months ago

Description

Some user would use the default SECRET_TOKEN value from the .env file which is insecure.

The change will prompt user to update the SECRET_TOKEN value if it runs in the dev mode and will not start the server if it is in the production environment.


Additionally this PR will restrict the dev environment to use node v14 to align with the maven build.

Tests

(If CI test fails due to known issue, please specify the issue and test PR locally. Then copy & paste the result of "mvn test" to here.)

Changes that Break Backward Compatibility (Optional)

(Consider including all behavior changes for public methods or API. Also include these changes in merge description so that other developers are aware of these changes. This allows them to make relevant code changes in feature branches accounting for the new method/API behavior.)

Documentation (Optional)

(Link the GitHub wiki you added)

Commits

Code Quality