chrisfu/prole
1
0
Fork 0
mirror of https://github.com/dredx/prole.git synced 2026-09-23 10:13:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix(oauth2-proxy): use openssl rand -base64 24 for cookie secret (32 chars = 32 bytes AES-valid)

Browse Source 
openssl rand -base64 32 produces a 44-char string; oauth2-proxy treats it
as 44 raw bytes and rejects it. -base64 24 encodes 24 bytes → 32 base64
chars with no padding, which satisfies the 32-byte AES requirement.
This commit is contained in:
chrisfu 2026-05-06 17:02:17 -04:00
parent 8eddb2e892
commit d4deac643d
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
etc/fetch_prole_secrets.sh
View File

@ -10,7 +10,7 @@
#
# Cookie secret:
# If already stored as field 'cookie_secret' in db-prole-org, uses that.
# Otherwise generates a new 32-byte base64 secret, writes it to
# Otherwise generates a 32-char base64 secret (openssl rand -base64 24 → 32 chars = 32 bytes, valid for AES), writes it to
# etc/secrets/oauth2-proxy-cookie-secret-prole, and saves it back to the
# db-prole-org item so it's durable in 1Password.
#
@ -78,7 +78,7 @@ COOKIE_SECRET="$(op item get "db-prole-org" --fields label=cookie_secret --revea
if [[ -z "$COOKIE_SECRET" ]]; then
log " No cookie_secret field in db-prole-org — generating new 32-byte secret ..."
COOKIE_SECRET="$(openssl rand -base64 32)"
COOKIE_SECRET="$(openssl rand -base64 24)"
log " Saving cookie_secret back to db-prole-org in 1Password ..."
op item edit "db-prole-org" \