From 961fc6752844f047d28de0ee01c22fe0ec710428 Mon Sep 17 00:00:00 2001 From: caoimhinr Date: Mon, 25 May 2026 19:46:25 +0200 Subject: [PATCH] security: timing-safe API key comparison, remove hardcoded DB password - Use hmac.compare_digest for constant-time key check (router.py) - Move POSTGRES_PASSWORD out of docker-compose.yml into .env (was a public default "corvid" now that the repo is public) - Add .env.example with placeholder values Co-Authored-By: Claude Sonnet 4.6 --- .env.example | 3 +++ corvid/router.py | 5 ++++- docker-compose.yml | 3 ++- 3 files changed, 9 insertions(+), 2 deletions(-) create mode 100644 .env.example diff --git a/.env.example b/.env.example new file mode 100644 index 0000000..bcc7994 --- /dev/null +++ b/.env.example @@ -0,0 +1,3 @@ +DATABASE_URL=postgresql+asyncpg://corvid:changeme@postgres:5432/corvid +TICKETS_API_KEY=changeme-use-a-long-random-value +POSTGRES_PASSWORD=changeme diff --git a/corvid/router.py b/corvid/router.py index 8443c91..1e75812 100644 --- a/corvid/router.py +++ b/corvid/router.py @@ -1,3 +1,4 @@ +import hmac import uuid from fastapi import APIRouter, Depends, Header, HTTPException, Query, Request @@ -101,7 +102,9 @@ def make_router(api_key: str, get_db, require_user=None) -> APIRouter: router = APIRouter() def _api_key_ok(x_api_key: str | None) -> bool: - return bool(api_key and x_api_key == api_key) + if not api_key or not x_api_key: + return False + return hmac.compare_digest(x_api_key, api_key) def require_ticket_auth( request: Request, diff --git a/docker-compose.yml b/docker-compose.yml index f158e1b..9796bb7 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -1,9 +1,10 @@ services: postgres: image: postgres:16-alpine + env_file: + - .env environment: POSTGRES_USER: corvid - POSTGRES_PASSWORD: corvid POSTGRES_DB: corvid volumes: - pgdata:/var/lib/postgresql/data