Conversation
The shipped configuration uses a fixed placeholder API secret
("you-must-replace-this"). Because this secret signs login and API
(JWT) tokens, an instance left on the placeholder signs its tokens
with a publicly-known key. Replace the placeholder (or an empty
secret) with `openssl rand -base64 32` in postinst on first install,
mirroring the existing OpenWrt uci-defaults behaviour.
Only the placeholder / empty value is rewritten, so an operator's own
secret is never overwritten and it is safe on upgrade (chirpstack.toml
is a dpkg conffile).
The api.secret value signs login and API tokens (HS256 JWT). When it is
left empty or set to the example placeholder ("you-must-replace-this"),
the signing key is known and tokens can be forged, bypassing
authentication. Log a warning once during API setup so operators running
an unconfigured or example-derived config are alerted.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
As discussed over email re: the default
[api]secret.The Debian package ships
chirpstack.tomlwith the placeholdersecret = "you-must-replace-this". Since that value signs login/API(JWT) tokens, an instance left on the placeholder signs tokens with a
publicly-known key.
This extends
debian/postinstto replace the placeholder (or an emptysecret) with
openssl rand -base64 32on first install, mirroring theexisting OpenWrt
uci-defaults/90_set_random_api_keybehaviour. Only theplaceholder/empty value is rewritten, so an operator's own secret is never
overwritten, and it is safe on upgrade (chirpstack.toml is a dpkg conffile).
Happy to also cover the Docker/systemd path or add an app-level startup
warning when the secret is empty/placeholder, if you'd like — just let me know.