Skip to content

1212 #80

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
biff990 wants to merge 5 commits into
base: main
Choose a base branch
from
Open

1212 #80

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
d947661
fix: 示例 AUTH_SECRET 使用 UUID
Y80 Nov 12, 2024
b13cfe2
fix: next-auth 中明确指定 secret
Y80 Nov 12, 2024
3e9df76
log process.env
Y80 Nov 12, 2024
7c7ffdd
fix: Vercel 上无法使用 AUTH_SECRET
Y80 Nov 12, 2024
46142ca
Update .env
biff990 Nov 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .env
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,11 +33,11 @@ AUTH_URL

# Github OAuth APP 配置
# 下面这对配置可以用于 http://localhost:PORT，其它地址用不了！请务必及时替换为你自己的！
AUTH_GITHUB_ID = 62519d5cf7e8098627cf
AUTH_GITHUB_SECRET = cd46f95c2186109c65c6b0bb874a8da6a02868a3
AUTH_GITHUB_ID = Ov23lit5CvhIVzhNgubm
AUTH_GITHUB_SECRET = f8ab00b9a09bba69c65752ba32d8987b1b9b8d4d

# 加密令牌用到的密钥。建议使用 UUID。
AUTH_SECRET = "请把我替换为一个UUID"
# ! 用于加密令牌用到的密钥。请及时替换 UUID。
AUTH_SECRET = "f8ab00b9a09bba69c65752ba32d8987b1b9b8d4d"

# ================================================================================

Expand Down
9 changes: 8 additions & 1 deletion next.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,15 @@ export default async function setup() {
dangerouslyAllowSVG: true,
},

webpack: (config) => {
webpack: (config, { webpack, nextRuntime }) => {
config.plugins.push(codeInspectorPlugin({ bundler: 'webpack', hideDomPathAttr: false }))
// https://github.com/vercel/next.js/discussions/39705
// fix: edge 环境无法加载环境变量
if (nextRuntime === 'edge') {
config.plugins.push(new webpack.DefinePlugin({
"process.env.AUTH_SECRET": JSON.stringify(process.env.AUTH_SECRET),
}))
}
return config
},
}
Expand Down
20 changes: 15 additions & 5 deletions src/middleware.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,12 +15,15 @@ export default auth((req) => {
}
// 默认为 true，仅对于少数请求免除验证
let checkAdmin = true
const prefixes = ['/_next', '/api/auth', '/tag']
const affixes = ['.svg', '.png']
const whitelist = {
prefixes: ['/_next', '__next', '/api/auth', '/tag'],
affixes: ['.svg', '.png'],
pathnames: ['/', '/recent', '/search', '/login', '/forbidden', '/404', '/500', '/_error'],
}
if (
affixes.some((p) => pathname.endsWith(p)) ||
prefixes.some((p) => pathname.startsWith(p)) ||
['/', '/recent', '/search', '/login', '/forbidden'].includes(pathname)
whitelist.affixes.some((p) => pathname.endsWith(p)) ||
whitelist.prefixes.some((p) => pathname.startsWith(p)) ||
whitelist.pathnames.includes(pathname)
) {
checkAdmin = false
}
Expand All @@ -35,3 +38,10 @@ export default auth((req) => {
}
return NextResponse.next()
})

console.log(
'envs:',
process.env.AUTH_SECRET,

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Stop logging the session encryption secret

Whenever the middleware module initializes, this prints AUTH_SECRET to deployment logs. Because Auth.js uses this value to protect JWT session cookies, anyone with access to retained or aggregated logs can obtain the key and potentially decrypt or forge authenticated sessions; remove the log or restrict it to non-sensitive metadata.

Useful? React with 👍 / 👎.

process.env.MY_SECRET,
process.env.FETCH_GITHUB_TOKEN_PROXY
)