SidharthPL/Canteen-Management-System
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: sanitize codebase by removing hardcoded default secrets and enforcing environment variables

Browse Source
This commit is contained in:
Shanmuga Krishnan S M
2026-04-28 14:37:25 +05:30
parent 06184a0178
commit 6b864f9c49
3 changed files with 27 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
backend/src/main/java/com/rit/canteen/sales/service/SystemUserService.java
View File

@@ -20,10 +20,10 @@ public class SystemUserService {
@Autowired
private BCryptPasswordEncoder passwordEncoder;
@Value("${app.master.username:admin}")
@Value("${app.master.username}")
private String masterUsername;
@Value("${app.master.password:admin}")
@Value("${app.master.password}")
private String masterPassword;
@PostConstruct

19
backend/src/main/resources/application.properties
View File

@@ -2,12 +2,12 @@ spring.application.name=backend
server.address=0.0.0.0
# ============================================================
# DATABASE — use environment variables in production
# Set DB_URL, DB_USER, DB_PASSWORD as env vars before running
# DATABASE — REQUIRED environment variables
# Set these in your environment or a .env file
# ============================================================
spring.datasource.url=${DB_URL:jdbc:postgresql://localhost:5432/positeasy}
spring.datasource.username=${DB_USER:postgres}
spring.datasource.password=${DB_PASSWORD:sidharth}
spring.datasource.password=${DB_PASSWORD}
spring.datasource.driver-class-name=org.postgresql.Driver
spring.jpa.hibernate.ddl-auto=update
@@ -16,17 +16,17 @@ spring.jpa.properties.hibernate.dialect=org.hibernate.dialect.PostgreSQLDialect
spring.jpa.properties.hibernate.jdbc.time_zone=Asia/Kolkata
# ============================================================
# JWT — CHANGE THIS SECRET IN PRODUCTION (min 256-bit key)
# Set JWT_SECRET as an environment variable before running
# JWT — REQUIRED environment variables
# MUST provide a secure random key (min 256-bit)
# ============================================================
app.jwt.secret=${JWT_SECRET:3RiTCaNtEeNsUpErSeCrEtKeY2026!!xYzAbCdEfGhIjKlMn}
app.jwt.secret=${JWT_SECRET}
app.jwt.expiration-ms=86400000
# ============================================================
# Master Account — use environment variables in production
# Master Account — REQUIRED environment variables
# ============================================================
app.master.username=${MASTER_USER:admin}
app.master.password=${MASTER_PASSWORD:admin}
app.master.username=${MASTER_USER}
app.master.password=${MASTER_PASSWORD}
# File upload configuration
spring.servlet.multipart.max-file-size=10MB
@@ -34,6 +34,5 @@ spring.servlet.multipart.max-request-size=10MB
# ============================================================
# CORS — comma-separated list of allowed frontend origins
# Set APP_CORS_ORIGINS as env var in production
# ============================================================
app.cors.allowed-origins=${APP_CORS_ORIGINS:http://localhost:5173,http://localhost:5174,http://localhost:3000}