hof 23.0.1 → 23.0.2

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 2026-03-17, Version 23.0.2 (Stable), @vivekkumar-ho
+
+### Fixed
+- Improved session secret validation so missing or blank values now fail fast with a clearer startup error.
+- Reused the validated session secret consistently across cookie parsing, session encryption, and Redis session storage.
+
 ## 2025-03-04, Version 23.0.1 (Stable), @PaolaDMadd-Pro @Rhodine-orleans-lindsay
 ### ⚠️ Versioning Notice
 v23.0.1 is published as a patch due to a prior publishing issue.

package/lib/sessions.js

@@ -7,17 +7,28 @@ const cookieParser = require('cookie-parser');
 
 const secureHttps = config => config.protocol === 'https' || config.env === 'production';
 
-module.exports = (app, config) => {
-  const logger = config.logger || console;
+const validateSessionSecret = secret => {
+  if (!secret || !String(secret).trim()) {
+    throw new Error(
+      'Session secret is required. Set the SESSION_SECRET environment variable to a 32-byte value.'
+    );
+  }
 
-  const secretBuffer = Buffer.from(config.session.secret, 'utf8');
+  const secretBuffer = Buffer.from(secret, 'utf8');
   if (secretBuffer.byteLength !== 32) {
     throw new Error(
       `Session secret must be exactly 32 bytes. Current: ${secretBuffer.byteLength} bytes.`
     );
   }
 
-  app.use(cookieParser(config.session.secret, {
+  return secret;
+};
+
+module.exports = (app, config) => {
+  const logger = config.logger || console;
+  const sessionSecret = validateSessionSecret(config.session.secret);
+
+  app.use(cookieParser(sessionSecret, {
     path: '/',
     httpOnly: true,
     secure: secureHttps(config)
@@ -32,7 +43,7 @@ module.exports = (app, config) => {
     }));
   }
 
-  const encryption = require('./encryption')(config.session.secret);
+  const encryption = require('./encryption')(sessionSecret);
   const RedisStore = connectRedis(session);
   const client = redis.createClient(config.redis);
 
@@ -57,7 +68,7 @@ module.exports = (app, config) => {
   const store = new RedisStore({
     client: client,
     ttl: config.session.ttl,
-    secret: config.session.secret,
+    secret: sessionSecret,
     serializer: {
       parse: data => JSON.parse(encryption.decrypt(data)),
       stringify: data => encryption.encrypt(JSON.stringify(data))
@@ -74,7 +85,7 @@ module.exports = (app, config) => {
       sameSite: config.cookie?.sameSite === 'lax' ? config.cookie?.sameSite : 'strict',
       httpOnly: true
     },
-    secret: config.session.secret,
+    secret: sessionSecret,
     saveUninitialized: true,
     resave: true
   }, config.session);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hof",
   "description": "A bootstrap for HOF projects",
-  "version": "23.0.1",
+  "version": "23.0.2",
   "license": "MIT",
   "main": "index.js",
   "author": "HomeOffice",