SidharthPL/Canteen-Management-System
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: sanitize codebase by removing hardcoded default secrets and enforcing environment variables

Browse Source
This commit is contained in:
Shanmuga Krishnan S M
2026-04-28 14:37:25 +05:30
parent 06184a0178
commit 6b864f9c49
3 changed files with 27 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
README.md
View File

@@ -4,6 +4,22 @@
This branch represents a major security milestone for the Canteen Automation system, transitioning from open/unprotected endpoints to a robust **JWT-based Authentication** architecture.
### 🔐 Critical: Security Configuration
To run this application securely, you **MUST** configure the following environment variables. Do **NOT** commit real secrets to the repository.
#### Required Environment Variables
| Variable | Description | Example/Hint |
| :--- | :--- | :--- |
| `JWT_SECRET` | Secret key for signing tokens | `openssl rand -base64 32` |
| `DB_PASSWORD` | Database user password | Your PostgreSQL password |
| `MASTER_USER` | Initial admin email | `admin@example.com` |
| `MASTER_PASSWORD` | Initial admin password | `SecurePassword123` |
#### How to set them:
- **Local Development**: Create a `.env` file (if using a loader) or set them in your IDE (IntelliJ/Eclipse) Run Configurations.
- **Production**: Set them as System Environment Variables on your server or CI/CD platform (e.g., GitHub Secrets, Railway, Docker).
### 🏗️ Ecosystem Architecture
- **Backend (Java/Spring Boot)**: Now fully protected by JWT guards. Includes `JwtAuthFilter`, `JwtUtil`, and enhanced `SecurityConfig`.
- **Frontend (Counter/Admin)**: Migrated to use an authenticated API wrapper (`src/api.ts`).

4
backend/src/main/java/com/rit/canteen/sales/service/SystemUserService.java
View File

@@ -20,10 +20,10 @@ public class SystemUserService {
@Autowired
private BCryptPasswordEncoder passwordEncoder;
@Value("${app.master.username:admin}")
@Value("${app.master.username}")
private String masterUsername;
@Value("${app.master.password:admin}")
@Value("${app.master.password}")
private String masterPassword;
@PostConstruct

19
backend/src/main/resources/application.properties
View File

@@ -2,12 +2,12 @@ spring.application.name=backend
server.address=0.0.0.0
# ============================================================
# DATABASE — use environment variables in production
# Set DB_URL, DB_USER, DB_PASSWORD as env vars before running
# DATABASE — REQUIRED environment variables
# Set these in your environment or a .env file
# ============================================================
spring.datasource.url=${DB_URL:jdbc:postgresql://localhost:5432/positeasy}
spring.datasource.username=${DB_USER:postgres}
spring.datasource.password=${DB_PASSWORD:sidharth}
spring.datasource.password=${DB_PASSWORD}
spring.datasource.driver-class-name=org.postgresql.Driver
spring.jpa.hibernate.ddl-auto=update
@@ -16,17 +16,17 @@ spring.jpa.properties.hibernate.dialect=org.hibernate.dialect.PostgreSQLDialect
spring.jpa.properties.hibernate.jdbc.time_zone=Asia/Kolkata
# ============================================================
# JWT — CHANGE THIS SECRET IN PRODUCTION (min 256-bit key)
# Set JWT_SECRET as an environment variable before running
# JWT — REQUIRED environment variables
# MUST provide a secure random key (min 256-bit)
# ============================================================
app.jwt.secret=${JWT_SECRET:3RiTCaNtEeNsUpErSeCrEtKeY2026!!xYzAbCdEfGhIjKlMn}
app.jwt.secret=${JWT_SECRET}
app.jwt.expiration-ms=86400000
# ============================================================
# Master Account — use environment variables in production
# Master Account — REQUIRED environment variables
# ============================================================
app.master.username=${MASTER_USER:admin}
app.master.password=${MASTER_PASSWORD:admin}
app.master.username=${MASTER_USER}
app.master.password=${MASTER_PASSWORD}
# File upload configuration
spring.servlet.multipart.max-file-size=10MB
@@ -34,6 +34,5 @@ spring.servlet.multipart.max-request-size=10MB
# ============================================================
# CORS — comma-separated list of allowed frontend origins
# Set APP_CORS_ORIGINS as env var in production
# ============================================================
app.cors.allowed-origins=${APP_CORS_ORIGINS:http://localhost:5173,http://localhost:5174,http://localhost:3000}