Repository navigation
fix(client): reject spaced secret keys in web pages - #9
Merged
MobileMage merged 2 commits intoOct 4, 2026
Merged
Conversation
SEC-1 must hold when header normalisation strips leading white space. Cover both secret key forms before changing the browser guard (T-1). Signed-off-by: Lui Lui <40736418+lui01212@users.noreply.github.com>
Check the trimmed key before applying SEC-1, because header normalisation removes white space. Signed-off-by: Lui Lui <40736418+lui01212@users.noreply.github.com>
Collaborator
|
Merged as 69d7dd4. The test commit before the fix, with a CI run that shows the eight cases failing on the old guard, made the review easy. The field package trims the key too, so both layers now refuse a padded secret key. One related question is still open in the issue: whether the guard should allow only the publishable prefix instead of refusing the two secret ones. That needs a change to |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Check the trimmed API key before applying the browser secret-key guard (SEC-1). Leading white
space can otherwise hide a secret-key prefix that header normalisation later exposes. Add eight
regression cases for both secret-key forms and a patch changeset.
All eight new cases fail on the old guard. pnpm check, Node 22 tests, Firefox and WebKit journeys,
secret scanning and the PR checks pass after the fix. The existing tests also cover publishable
keys and server clients. The error message never contains the key.
CI: https://github.com/lui01212/js/actions/runs/37173546409
Before the fix: https://github.com/lui01212/js/actions/runs/37173442275
Closes #7
Codex helped write the guard change, tests and changeset, and review the diff.
Signed-off-by: Lui Lui 40736418+lui01212@users.noreply.github.com