Skip to content

feat: add API key authentication middleware #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
abhinavguptas wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat: add API key authentication middleware #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion app.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,16 +1,19 @@
const express = require('express');
const tasksRouter = require('./routes/tasks');
const { authenticate } = require('./middleware/auth');

const app = express();
const PORT = process.env.PORT || 3000;

app.use(express.json());

// Public endpoint — no auth required
app.get('/health', (req, res) => {
res.json({ status: 'ok' });
});

app.use('/tasks', tasksRouter);
// All task routes require authentication
app.use('/tasks', authenticate, tasksRouter);

app.listen(PORT, () => {
console.log(`Server running on port ${PORT}`);
Expand Down
20 changes: 20 additions & 0 deletions middleware/auth.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
// Simple API key authentication middleware
// Reads the expected key from API_KEY environment variable

const authenticate = (req, res, next) => {
const apiKey = req.headers['x-api-key'];
const expectedKey = process.env.API_KEY;

if (!expectedKey) {
// Auth not configured — skip in development

@github-actions github-actions Bot Apr 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 [HIGH] security: Unsafe Authentication Bypass in Production

The if (!expectedKey) condition allows authentication to be completely bypassed if the API_KEY environment variable is not set. While intended for development, this is a critical security vulnerability if deployed to production without the variable configured, making all /tasks routes publicly accessible. Authentication should fail loudly in production if the key is missing.

Suggestion:

Suggested change
// Auth not configured — skip in development
if (!expectedKey) {
if (process.env.NODE_ENV === 'production') {
console.error('API_KEY environment variable is not set in production. Authentication is disabled.');
return res.status(500).json({ error: 'Server configuration error' });
}
// Allow bypass in non-production environments for convenience
return next();
}

return next();
}

if (!apiKey || apiKey !== expectedKey) {
return res.status(401).json({ error: 'Unauthorized' });

@github-actions github-actions Bot Apr 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 [MEDIUM] security: Potential Timing Attack Vulnerability

The direct string comparison apiKey !== expectedKey could potentially be vulnerable to timing attacks, where an attacker might infer the API key character by character based on slight differences in response times. For sensitive comparisons like API keys, a constant-time string comparison function is recommended to mitigate this risk.

}

next();
};

module.exports = { authenticate };
Loading