diff --git a/examples/getstarted/config/middlewares.js b/examples/getstarted/config/middlewares.js index 6fa89bc6f7..cbec888afb 100644 --- a/examples/getstarted/config/middlewares.js +++ b/examples/getstarted/config/middlewares.js @@ -10,12 +10,7 @@ module.exports = ({ env }) => [ 'strapi::logger', 'strapi::query', 'strapi::body', - { - name: 'strapi::session', - config: { - secretKeys: env('SESSION_SECRET_KEYS'), - }, - }, + 'strapi::session', // 'strapi::compression', // 'strapi::ip', { diff --git a/examples/getstarted/config/server.js b/examples/getstarted/config/server.js index eb9b994112..e3e514d0bc 100644 --- a/examples/getstarted/config/server.js +++ b/examples/getstarted/config/server.js @@ -5,8 +5,12 @@ const cronTasks = require('./src/cron-tasks'); module.exports = ({ env }) => ({ host: env('HOST', '0.0.0.0'), port: env.int('PORT', 1337), + url: 'http://localhost:1337', cron: { enabled: true, tasks: cronTasks, }, + app: { + keys: env.array('APP_SECRETS', ['toBeModified1', 'toBeModified2']), + }, }); diff --git a/packages/core/strapi/lib/middlewares/session.js b/packages/core/strapi/lib/middlewares/session.js index 7a5bb31dfb..a298dac0ea 100644 --- a/packages/core/strapi/lib/middlewares/session.js +++ b/packages/core/strapi/lib/middlewares/session.js @@ -1,7 +1,6 @@ 'use strict'; -const crypto = require('crypto'); -const { defaultsDeep, isEmpty, isString, omit, has } = require('lodash/fp'); +const { defaultsDeep, isEmpty, isArray } = require('lodash/fp'); const session = require('koa-session'); const defaultConfig = { @@ -13,34 +12,17 @@ const defaultConfig = { signed: true, rolling: false, renew: false, - secure: false, + secure: process.env.NODE_ENV === 'production' ? true : false, sameSite: null, }; module.exports = (userConfig, { strapi }) => { - if (isEmpty(strapi.server.app.keys)) { - let secretKeys = []; - - if (has('secretKeys', userConfig)) { - secretKeys = isString(userConfig.secretKeys) - ? userConfig.secretKeys.split(',') - : userConfig.secretKeys; - } else if (has('SESSION_SECRET_KEYS', process.env)) { - secretKeys = process.env.SESSION_SECRET_KEYS.split(','); - } else { - // auto generate secret keys if they are not provided - for (let i = 0; i < 4; i++) { - secretKeys.push(crypto.randomBytes(64).toString('hex')); - } - strapi.fs.appendFile('.env', `SESSION_SECRET_KEYS=${secretKeys.join(',')}\n`); - strapi.log.info( - 'The session middleware automatically generated some secret keys and stored them in your .env file under the name SESSION_SECRET_KEYS.' - ); - } - - strapi.server.app.keys = secretKeys; + const keys = strapi.server.app.keys; + if (!isArray(keys) || isEmpty(keys) || keys.some(isEmpty)) { + throw new Error(`App keys are required. Please set app.keys in config/server.js (ex: keys: ['myKeyA', 'myKeyB'])`); } - const config = defaultsDeep(defaultConfig, omit('secretKeys', userConfig)); + + const config = defaultsDeep(defaultConfig, userConfig); strapi.server.use(session(config, strapi.server.app)); }; diff --git a/packages/core/strapi/lib/services/server/index.js b/packages/core/strapi/lib/services/server/index.js index e181fd70f0..78f8d25a7e 100644 --- a/packages/core/strapi/lib/services/server/index.js +++ b/packages/core/strapi/lib/services/server/index.js @@ -28,7 +28,10 @@ const healthCheck = async ctx => { * @returns {Server} */ const createServer = strapi => { - const app = createKoaApp({ proxy: strapi.config.get('server.proxy') }); + const app = createKoaApp({ + proxy: strapi.config.get('server.proxy'), + keys: strapi.config.get('server.app.keys'), + }); const router = new Router(); diff --git a/packages/core/strapi/lib/services/server/koa.js b/packages/core/strapi/lib/services/server/koa.js index 6a0e3b521d..1c98f6160f 100644 --- a/packages/core/strapi/lib/services/server/koa.js +++ b/packages/core/strapi/lib/services/server/koa.js @@ -53,8 +53,9 @@ const addCustomMethods = app => { return app; }; -const createKoaApp = ({ proxy }) => { +const createKoaApp = ({ proxy, keys }) => { const app = new Koa({ proxy }); + app.keys = keys; addCustomMethods(app); diff --git a/packages/generators/app/lib/create-project.js b/packages/generators/app/lib/create-project.js index da5b2d69fc..5095b45d77 100644 --- a/packages/generators/app/lib/create-project.js +++ b/packages/generators/app/lib/create-project.js @@ -17,6 +17,7 @@ const mergeTemplate = require('./utils/merge-template.js'); const packageJSON = require('./resources/json/package.json'); const createDatabaseConfig = require('./resources/templates/database.js'); const createAdminConfig = require('./resources/templates/admin-config.js'); +const createEnvFile = require('./resources/templates/env.js'); module.exports = async function createProject(scope, { client, connection, dependencies }) { console.log(`Creating a new Strapi application at ${chalk.green(scope.rootPath)}.`); @@ -30,6 +31,7 @@ module.exports = async function createProject(scope, { client, connection, depen await fse.copy(join(resources, 'files'), rootPath); // copy dot files + await fse.writeFile(join(rootPath, '.env'), createEnvFile()); const dotFiles = await fse.readdir(join(resources, 'dot-files')); await Promise.all( dotFiles.map(name => { diff --git a/packages/generators/app/lib/resources/dot-files/env.example b/packages/generators/app/lib/resources/dot-files/env.example deleted file mode 100644 index b667b6c4a1..0000000000 --- a/packages/generators/app/lib/resources/dot-files/env.example +++ /dev/null @@ -1,2 +0,0 @@ -HOST=0.0.0.0 -PORT=1337 diff --git a/packages/generators/app/lib/resources/files/config/server.js b/packages/generators/app/lib/resources/files/config/server.js index d3f42a3fc5..79c2c846fa 100644 --- a/packages/generators/app/lib/resources/files/config/server.js +++ b/packages/generators/app/lib/resources/files/config/server.js @@ -1,4 +1,8 @@ module.exports = ({ env }) => ({ host: env('HOST', '0.0.0.0'), port: env.int('PORT', 1337), + url: env('URL', 'http://localhost:1337'), + app: { + keys: env.array('APP_SECRETS'), + }, }); diff --git a/packages/generators/app/lib/resources/templates/env.js b/packages/generators/app/lib/resources/templates/env.js new file mode 100644 index 0000000000..07a1c57998 --- /dev/null +++ b/packages/generators/app/lib/resources/templates/env.js @@ -0,0 +1,16 @@ +'use strict'; + +const crypto = require('crypto'); + +const fs = require('fs'); +const path = require('path'); +const _ = require('lodash'); + +module.exports = () => { + const tmpl = fs.readFileSync(path.join(__dirname, 'env.template')); + const compile = _.template(tmpl); + + return compile({ + appSecrets: new Array(4).fill().map(() => crypto.randomBytes(16).toString('base64')).join(','), + }); +}; diff --git a/packages/generators/app/lib/resources/templates/env.template b/packages/generators/app/lib/resources/templates/env.template new file mode 100644 index 0000000000..049c62249a --- /dev/null +++ b/packages/generators/app/lib/resources/templates/env.template @@ -0,0 +1,4 @@ +HOST=0.0.0.0 +PORT=1337 +URL=http://localhost:1337 +APP_SECRETS=<%= appSecrets %>