starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[PR #445] [MERGED] Only fall back to the default secret when no env var is provided #3347

New Issue
Closed
opened 2026-04-25 00:15:18 +02:00 by adam · 0 comments
adam commented 2026-04-25 00:15:18 +02:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/advplyr/audiobookshelf/pull/445
Author: @rasmuslos
Created: 4/9/2022
Status: ✅ Merged
Merged: 4/9/2022
Merged by: @advplyr

Base: master ← Head: token-env

📝 Commits (1)

  • 2df5ab0 Only fall back to the default secret when no is provided

📊 Changes

4 files changed (+216 additions, -133 deletions)

View changed files

📝 .gitignore (+2 -1)
📝 client/package-lock.json (+212 -129)
📝 index.js (+1 -2)
📝 prod.js (+1 -1)

📄 Description

Currently, all TOKEN_SECRETs are the same for all users. This is extremely insecure because everyone can decrypt secrets or connect to the DB.
Now users can provide their own TOKEN_SECRET to increase security.
Because the secret is also the DB password changing it requires backing up the previous instance, recreating it and then applying the backup

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/advplyr/audiobookshelf/pull/445 **Author:** [@rasmuslos](https://github.com/rasmuslos) **Created:** 4/9/2022 **Status:** ✅ Merged **Merged:** 4/9/2022 **Merged by:** [@advplyr](https://github.com/advplyr) **Base:** `master` ← **Head:** `token-env` --- ### 📝 Commits (1) - [`2df5ab0`](https://github.com/advplyr/audiobookshelf/commit/2df5ab0ddeb9815ef1bf1c8e2f29c74e0e107676) Only fall back to the default secret when no is provided ### 📊 Changes **4 files changed** (+216 additions, -133 deletions) <details> <summary>View changed files</summary> 📝 `.gitignore` (+2 -1) 📝 `client/package-lock.json` (+212 -129) 📝 `index.js` (+1 -2) 📝 `prod.js` (+1 -1) </details> ### 📄 Description Currently, all `TOKEN_SECRET`s are the same for all users. This is extremely insecure because everyone can decrypt secrets or connect to the DB. Now users can provide their own `TOKEN_SECRET` to increase security. Because the secret is also the DB password changing it requires backing up the previous instance, recreating it and then applying the backup --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
adam added the pull-request label 2026-04-25 00:15:18 +02:00
adam closed this issue 2026-04-25 00:15:18 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#3347
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?