-
-
Notifications
You must be signed in to change notification settings - Fork 347
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
create: make the default session secret default in all contexts #1123
Conversation
3ae3e7f
to
f12138a
Compare
Can you change the title? Or explain what it means? |
Is that title better? |
Yes, thank you. And what does |
The general topic of the commit. This commit is about the create family of functions. Each commit should describe what it's about so that reading git history is meaningful without reference to github or Phabricator. The commit messages should be useful on their own. |
Is this some general guideline? Can you share a link to it? |
The problem here is that making it this optional meant that it wasn't supplied by [the enterprise creation function](https://github.com/gristlabs/grist-ee/blob/fb22d94878a539ec9f1085fa9ac12936ccb68dca/ext/app/server/lib/create.ts#L10). This resulted in an odd situation where the secret was required for the enterprise edition, even though it offers no additional security. Without this key, the enterprise code crashes. The requirement to supply a secret key would make a Grist instance crash if you start in normal mode but switch to enterprise, as the enterprise creator does not supply a default secret key.
f12138a
to
6d34286
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
That looks right to me. Sorry the SaaS tied your hands for cleaning up more. Although the hard-coded secret has always been there and you are just moving it, could you add a comment to it summarizing our understanding of its significance?
6e239a8
to
37fe2c3
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks.
The problem here is that making it this optional meant that it wasn't supplied by the enterprise creation
function. This resulted in an odd situation where the secret was required for the enterprise edition, even though it offers no additional security. Without this key, the enterprise code crashes.
The requirement to supply a secret key would make a Grist instance crash if you start in normal mode but switch to enterprise, as the enterprise creator does not supply a default secret key.