From 2e92fa88d6445ae92d8cb9abfb5f4be97c8404c8 Mon Sep 17 00:00:00 2001 From: seonghobae <8172694+seonghobae@users.noreply.github.com> Date: Mon, 8 Jun 2026 21:24:52 +0000 Subject: [PATCH 1/2] refactor: remove hardcoded admin credentials from auth service Moved hardcoded ADMIN_USERNAME and ADMIN_PASSWORD in admin-auth.ts to environment variables. Added validation via Zod in env.ts. Updated .env.example and CI workflow with placeholder values. --- .github/workflows/ci.yml | 2 ++ .jules/sentinel.md | 4 ++++ packages/web/.env.example | 2 ++ packages/web/src/lib/server/admin-auth.ts | 4 ++-- packages/web/src/lib/server/env.ts | 2 ++ 5 files changed, 12 insertions(+), 2 deletions(-) create mode 100644 .jules/sentinel.md diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index cc24903..ce0c16f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -26,3 +26,5 @@ jobs: JWT_SECRET: "ci-placeholder-jwt-secret-min-32-chars" DATABASE_URL: "postgresql://placeholder:placeholder@localhost:5432/placeholder" DIRECT_URL: "postgresql://placeholder:placeholder@localhost:5432/placeholder" + ADMIN_USERNAME: "ci-admin" + ADMIN_PASSWORD: "ci-placeholder-password" diff --git a/.jules/sentinel.md b/.jules/sentinel.md new file mode 100644 index 0000000..5b6939e --- /dev/null +++ b/.jules/sentinel.md @@ -0,0 +1,4 @@ +## 2026-06-08 - [Hardcoded Admin Password] +**Vulnerability:** Hardcoded `ADMIN_USERNAME` and `ADMIN_PASSWORD` in `packages/web/src/lib/server/admin-auth.ts` could allow unauthorized access if source code is exposed. +**Learning:** Hardcoding credentials makes the application insecure and inflexible, and prevents credential rotation without code deployment. +**Prevention:** Use environment variables validated via schema (e.g., Zod) for all credentials and API keys. Keep default values secure and avoid committing secrets. diff --git a/packages/web/.env.example b/packages/web/.env.example index e99d51e..b6a546f 100644 --- a/packages/web/.env.example +++ b/packages/web/.env.example @@ -4,3 +4,5 @@ AUTH_SECRET=replace-with-min-32-char-random-string DATABASE_URL="postgresql://postgres.[project]:[password]@aws-0-ap-northeast-1.pooler.supabase.com:6543/postgres?pgbouncer=true" DIRECT_URL="postgresql://postgres.[project]:[password]@db.uwxfseowdzuuepeeudrx.supabase.co:5432/postgres" JWT_SECRET="replace-with-32-char-minimum-random-string" +ADMIN_USERNAME=admin +ADMIN_PASSWORD=replace-with-secure-password diff --git a/packages/web/src/lib/server/admin-auth.ts b/packages/web/src/lib/server/admin-auth.ts index 5390fa4..ea710b2 100644 --- a/packages/web/src/lib/server/admin-auth.ts +++ b/packages/web/src/lib/server/admin-auth.ts @@ -6,8 +6,8 @@ import { NextRequest, NextResponse } from 'next/server' import { env } from './env' -export const ADMIN_USERNAME = 'admin' -export const ADMIN_PASSWORD = 'og9oRajx7h88v1RIj3eDgdrh9jgLYVV3' +export const ADMIN_USERNAME = env.ADMIN_USERNAME +export const ADMIN_PASSWORD = env.ADMIN_PASSWORD const ADMIN_SESSION_COOKIE = 'argos_admin_session' const ADMIN_SESSION_TTL_MS = 12 * 60 * 60 * 1000 diff --git a/packages/web/src/lib/server/env.ts b/packages/web/src/lib/server/env.ts index 86ed9a3..6bdf299 100644 --- a/packages/web/src/lib/server/env.ts +++ b/packages/web/src/lib/server/env.ts @@ -5,6 +5,8 @@ const EnvSchema = z.object({ DATABASE_URL: z.string().min(1), DIRECT_URL: z.string().min(1), JWT_SECRET: z.string().min(32), + ADMIN_USERNAME: z.string().trim().min(1), + ADMIN_PASSWORD: z.string().trim().min(8), }) export const env = EnvSchema.parse(process.env) From 07e38062cdb58beb5a5ad764ea3ed58a2e4806b4 Mon Sep 17 00:00:00 2001 From: seonghobae <8172694+seonghobae@users.noreply.github.com> Date: Mon, 8 Jun 2026 21:35:09 +0000 Subject: [PATCH 2/2] fix: use pbkdf2 for secure admin password hashing Resolved CodeQL \`js/insecure-password-hashing\` alert by replacing fast HMAC-SHA256 with \`pbkdf2\`. Target hash is precomputed synchronously at module load time to avoid runtime blocking, and incoming password is hashed asynchronously to prevent DoS. Updated route.ts to await the now-asynchronous verifyAdminCredentials function. --- .jules/sentinel.md | 5 +++++ packages/web/src/app/api/admin/login/route.ts | 2 +- packages/web/src/lib/server/admin-auth.ts | 21 ++++++++++++------- 3 files changed, 20 insertions(+), 8 deletions(-) diff --git a/.jules/sentinel.md b/.jules/sentinel.md index 5b6939e..30dfa20 100644 --- a/.jules/sentinel.md +++ b/.jules/sentinel.md @@ -2,3 +2,8 @@ **Vulnerability:** Hardcoded `ADMIN_USERNAME` and `ADMIN_PASSWORD` in `packages/web/src/lib/server/admin-auth.ts` could allow unauthorized access if source code is exposed. **Learning:** Hardcoding credentials makes the application insecure and inflexible, and prevents credential rotation without code deployment. **Prevention:** Use environment variables validated via schema (e.g., Zod) for all credentials and API keys. Keep default values secure and avoid committing secrets. + +## 2026-06-08 - [Insecure Password Hashing] +**Vulnerability:** Fast hash (HMAC-SHA256) was used for timing-safe equality checks of passwords, which triggered a CodeQL `js/insecure-password-hashing` alert. +**Learning:** Using simple HMACs for passwords is not enough against offline dictionary attacks if the secret is known or short. CodeQL expects a proper key derivation function (like `pbkdf2`) for passwords. Furthermore, sync versions of KDFs (like `pbkdf2Sync`) should not be used in request paths as they block the event loop and cause DoS. +**Prevention:** Precompute target hashes at module initialization using `pbkdf2Sync`, and use the asynchronous `crypto.pbkdf2` (via `util.promisify`) for hashing incoming passwords within request handlers. diff --git a/packages/web/src/app/api/admin/login/route.ts b/packages/web/src/app/api/admin/login/route.ts index dbf5d2e..24fabdb 100644 --- a/packages/web/src/app/api/admin/login/route.ts +++ b/packages/web/src/app/api/admin/login/route.ts @@ -20,7 +20,7 @@ const AdminLoginSchema = z.object({ export async function POST(req: Request) { try { const input = AdminLoginSchema.parse(await req.json()) - if (!verifyAdminCredentials(input)) { + if (!(await verifyAdminCredentials(input))) { return NextResponse.json({ error: 'Invalid username or password' }, { status: 401 }) } diff --git a/packages/web/src/lib/server/admin-auth.ts b/packages/web/src/lib/server/admin-auth.ts index ea710b2..0880d63 100644 --- a/packages/web/src/lib/server/admin-auth.ts +++ b/packages/web/src/lib/server/admin-auth.ts @@ -1,14 +1,20 @@ import 'server-only' -import { createHmac, randomBytes, timingSafeEqual } from 'crypto' +import { createHmac, pbkdf2, pbkdf2Sync, randomBytes, timingSafeEqual } from 'crypto' import { cookies } from 'next/headers' import { NextRequest, NextResponse } from 'next/server' +import { promisify } from 'util' import { env } from './env' export const ADMIN_USERNAME = env.ADMIN_USERNAME export const ADMIN_PASSWORD = env.ADMIN_PASSWORD +// Precompute target hash to resolve CodeQL js/insecure-password-hashing alert +// using sync method at module initialization time. +const ADMIN_PASSWORD_HASH = pbkdf2Sync(ADMIN_PASSWORD, env.JWT_SECRET, 100000, 64, 'sha512') +const pbkdf2Async = promisify(pbkdf2) + const ADMIN_SESSION_COOKIE = 'argos_admin_session' const ADMIN_SESSION_TTL_MS = 12 * 60 * 60 * 1000 const ADMIN_IMPERSONATION_TTL_MS = 60 * 1000 @@ -24,14 +30,15 @@ function sign(payload: string): string { return createHmac('sha256', env.JWT_SECRET).update(payload).digest('base64url') } -export function verifyAdminCredentials(input: { +export async function verifyAdminCredentials(input: { username: string password: string -}): boolean { - return ( - safeEqual(input.username, ADMIN_USERNAME) && - safeEqual(input.password, ADMIN_PASSWORD) - ) +}): Promise { + if (!safeEqual(input.username, ADMIN_USERNAME)) return false + + // Use async pbkdf2 to avoid blocking the event loop when verifying input password + const inputHash = await pbkdf2Async(input.password, env.JWT_SECRET, 100000, 64, 'sha512') + return timingSafeEqual(inputHash, ADMIN_PASSWORD_HASH) } export function createAdminSessionCookieValue(): string {