Skip to content

v0.1.1 — Enforce SESSION_SECRET ≥ 32 bytes (security hardening)

Choose a tag to compare

View all tags
@alex-savin alex-savin released this 30 Jun 22:18
v0.1.1
0ca0f79

go-auth-x v0.1.1

A small security + docs hardening release. No API changes.

Security

  • SESSION_SECRET ≥ 32 bytes is now enforced at boot. New() fails closed when auth will mint cookies (OIDC configured, or a secret supplied for local/social methods) and the secret is shorter than 32 bytes — the guarantee the README already described but the code didn't enforce (it only required a non-empty secret). A short, weak HMAC key is now rejected at construction instead of silently signing every session/flow/CSRF cookie.

Fixed

  • Corrected the passkey rpID documentation: it's derived from the configured app origin (override via WEBAUTHN_RPID), not the request Host header — so it can't be spoofed. The prior "never host-inferred" wording was inaccurate.

Upgrade

go get github.com/alex-savin/go-auth-x@v0.1.1

Drop-in for v0.1.0. The one behavioral change: a SESSION_SECRET shorter than 32 bytes — or a missing secret when OIDC is configured — now returns an error from New() instead of being accepted. Set a 32+ byte secret (e.g. openssl rand -base64 32).

Full changelog: https://github.com/alex-savin/go-auth-x/blob/main/CHANGELOG.md

Assets 2
Loading