Take the session secret out of the repository, and the name out of the page

azer commented

2026-09-16 08:16:28 +00:00

Owner

The auth lesson shipped its own .env with a real SESSION_SECRET, so the first thing a student cloning it sees is the secret living in the tree. Untracked, .env added to .gitignore, .env.example names the two values, and PORT gets a default so the lesson still runs with no file at all. Two smaller things the same lesson taught by accident: /profile put the submitted username straight into HTML (signing in as an img tag with onerror was enough to run it), and the session stored the password it had already checked. Built and run without a .env: comes up on 3000, name renders escaped.

azer added 1 commit

2026-09-16 08:16:28 +00:00

Take the session secret out of the repository, and the name out of the page 2a7844beef

The auth lesson shipped its own .env, so the first thing a student cloning it
learns is that the secret goes in the tree. It is out, .env is ignored, and an
.env.example names the two values instead; PORT has a default so the lesson
still runs with no file at all.

Two other things the lesson taught by accident: the profile page put the
submitted name straight into HTML, and the session kept the password it had
already checked.

azer merged commit 9287dba67e into master

2026-09-16 15:39:30 +00:00

azer referenced this pull request from a commit

2026-09-16 15:39:31 +00:00

Merge pull request 'Take the session secret out of the repository, and the name out of the page' (#1) from azer/auth-lesson-hygiene into master

Rows
Columns

Take the session secret out of the repository, and the name out of the page #1