- Shipped
- September 23, 2026 at 10:12 AM UTC
- Author
- Kamo
- Commit
- e94af78
TranscriptionController, RecordingIngestController and RecordingProcessController all compared X-Internal-Auth with String.equals (a timing oracle on a shared secret) and defaulted **************** to the literal "dev-secret-change-in-prod" — both in the Java @Value annotation and in k8s/configmap.yaml's own placeholder default. The *** secretRef in deployment.yaml is `optional: true`, so an environment without that secret mounted fell through to a value that ships in this repo, and therefore in the image, rather than refusing service-to-service calls it could not verify. Now: MessageDigest.isEqual for the comparison, and every literal default removed (Java and ConfigMap) so an unset secret resolves to blank and every one of these controllers refuses the call. Confirmed safe for production before removing the defaults: kubectl shows the *** k8s Secret exists with a real **************** value in the kamo namespace, and deployment.yaml already pulls it in via envFrom/secretRef. New tests **************** **************** **************** cover the blank/null-secret refusal and, specifically, the case that distinguishes old from new behaviour: with the secret forced blank, "".equals("") is true, so the OLD single `auth == null || **************** check let a caller who sent an EMPTY X-Internal-Auth header straight through to business logic. Mutation-checked against the pre-fix controllers: 3 of 13 tests (exactly the three **************** cases) go red without this fix.