@webdecoy/fcaptcha 1.33.0 → 1.33.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/config.js +10 -1
- package/package.json +1 -1
package/config.js
CHANGED
|
@@ -2,11 +2,20 @@
|
|
|
2
2
|
|
|
3
3
|
const INSECURE_DEFAULT_SECRET = 'dev-secret-change-in-production';
|
|
4
4
|
|
|
5
|
+
// The library constructs the secret more than once per process (the challenge
|
|
6
|
+
// store and the scoring engine each resolve it), which printed the dev-mode
|
|
7
|
+
// warning twice. Once is the warning; twice is noise that trains people to
|
|
8
|
+
// scroll past it.
|
|
9
|
+
let devModeWarned = false;
|
|
10
|
+
|
|
5
11
|
function signingSecretFromEnv(env = process.env) {
|
|
6
12
|
const secret = String(env.FCAPTCHA_SECRET || '').trim();
|
|
7
13
|
if (secret && secret !== INSECURE_DEFAULT_SECRET) return secret;
|
|
8
14
|
if (/^(1|true|yes|on)$/i.test(String(env.FCAPTCHA_INSECURE_DEV_MODE || '').trim())) {
|
|
9
|
-
|
|
15
|
+
if (!devModeWarned) {
|
|
16
|
+
devModeWarned = true;
|
|
17
|
+
console.warn('WARNING: FCAPTCHA_INSECURE_DEV_MODE enabled; tokens use a public signing key. Never expose this server to a network.');
|
|
18
|
+
}
|
|
10
19
|
return INSECURE_DEFAULT_SECRET;
|
|
11
20
|
}
|
|
12
21
|
throw new Error('FCAPTCHA_SECRET is required and must not be the public development key. For local-only development, explicitly set FCAPTCHA_INSECURE_DEV_MODE=1.');
|