twenty icon indicating copy to clipboard operation
twenty copied to clipboard

Introduce APP_SECRET to replace SECRETS

Open FelixMalfait opened this issue 11 months ago • 44 comments

Context

We currently have 4 environment variables to specify our SECRETS in packages/twenty-server/.env:

  • ACCESS_TOKEN_SECRET
  • LOGIN_TOKEN_SECRET
  • REFRESH_TOKEN_SECRET
  • FILE_TOKEN_SECRET

We would like to replace those by a unique APP_SECRET env variable and to generate those 4 when needed as:

  • ACCESS_TOKEN_SECRET=SHA256({APP_SECRET}+{workspaceId}+"ACCESS")
  • LOGIN_TOKEN_SECRET=SHA256({APP_SECRET}+{workspaceId}+"FILE")
  • ...

What & How

  • Remove those 4 secrets from the code base
  • introduce APP_SECRET instead (this needs to be introduced in several places, I would recommend look for ACCESS_TOKEN_SECRET and to mimick it)
  • compute accessTokenSecret based on the formula above whenever it's needed

FelixMalfait avatar Mar 20 '24 15:03 FelixMalfait