Security updates (#1238)

Author: tomchop

core/schemas/user.py

@@ -20,6 +20,8 @@
     "writer": roles.Role.WRITER,
 }
 SECRET_KEY = yeti_config.get("auth", "secret_key")
+if not SECRET_KEY:
+    raise RuntimeError("You must set auth.secret_key in the configuration file.")
 ALGORITHM = yeti_config.get("auth", "algorithm")
 
 

core/web/apiv2/auth.py

@@ -26,6 +26,9 @@
     minutes=yeti_config.get("auth", "browser_token_expire_minutes", default=43200)
 )
 SECRET_KEY = yeti_config.get("auth", "secret_key")
+if not SECRET_KEY:
+    raise RuntimeError("You must set auth.secret_key in the configuration file.")
+
 ALGORITHM = yeti_config.get("auth", "algorithm")
 YETI_AUTH = yeti_config.get("auth", "enabled")
 YETI_WEBROOT = yeti_config.get("system", "webroot")

core/web/webapp.py

@@ -27,7 +27,7 @@
 
 SECRET_KEY = yeti_config.get("auth", "secret_key")
 if not SECRET_KEY:
-    SECRET_KEY = str(os.urandom(64))
+    raise RuntimeError("You must set auth.secret_key in the configuration file.")
 
 app = FastAPI()