GlcoinCore/specter-desktop
1
0
Fork 0
mirror of https://github.com/cryptoadvance/specter-desktop.git synced 2026-08-13 12:33:29 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

Add startup warning when SECRET_KEY is a known default (#2552)

Browse source
This commit is contained in:
Abhishek Kumar 2026-04-02 18:57:49 +05:30 • committed by GitHub
parent b6c230d1cb
commit 92951a4f33
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 18 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

18
src/cryptoadvance/specter/server.py
View file

@ -108,6 +108,24 @@ def create_app(config=None):
logger.info(f"Configuration: {config}")
app.config.from_object(config)
logger.info(f"SPECTER_DATA_FOLDER: {app.config['SPECTER_DATA_FOLDER']}")
# Warn if someone is running with a default SECRET_KEY on a non-localhost address.
# This can happen if SPECTER_CONFIG isn't set and someone accidentally ships with DevelopmentConfig.
_insecure_defaults = ("development key", "test key")
if app.config.get("SECRET_KEY") in _insecure_defaults:
host = app.config.get("HOST", "127.0.0.1")
if host not in ("127.0.0.1", "localhost", "0.0.0.0"):
logger.warning(
"WARNING: SECRET_KEY is set to a known default value and HOST is '%s'. "
"This is insecure for anything other than local development. "
"Please use ProductionConfig or set a proper SECRET_KEY.",
host,
)
else:
logger.info(
"Running with a default SECRET_KEY. Fine for local dev, not for production."
)
# Might be convenient to know later where it came from (see Service configuration)
app.config["SPECTER_CONFIGURATION_CLASS_FULLNAME"] = config_name
if not app.config.get("ENABLE_WERZEUG_REQUEST_LOGGING"):