search

nsarno / knock

Seamless JWT authentication for Rails API
MIT License
2.07k stars 253 forks source link

Crash if token_secret_signature_key returns empty string #257

Open Kukunin opened 4 years ago

Kukunin commented 4 years ago

The problem happened with a fork of knock which I was using for a long time: https://github.com/JonaMX/knock.

It worked well until I decided to upgrade to the newer fork of knock - this repository. I noticed that previous tokens stopped work and I started to dig.

It turned out, that in that fork, the author replaced to self.token_secret_signature_key = -> { Rails.application.credentials.read }, which returns an empty string "" for my Rails 5.2.

So I have been running the application for years with no secret signature key. Of course, it's my responsibility.

What I suggest is to add a check somewhere in the code so other potential users couldn't shoot in the foot again. Something like 

raise "Knock secret signature key can't be empty" if Knock.token_secret_signature_key.call.blank?
andrerpbts commented 4 years ago

Similar to #212

There's an open PR that we started a discussion about it: #225

Feel free to contribute there, with suggestions or opening a new PR considering the points raised there...

Thanks!