Config: Mandatory hmac key (#3955)

1 files changed, 12 insertions, 2 deletions

diff --git a/src/invidious/config.cr b/src/invidious/config.cr
index 9fc58409..e5f1e822 100644
--- a/src/invidious/config.cr
+++ b/src/invidious/config.cr
@@ -85,7 +85,7 @@ class Config
   # Used to tell Invidious it is behind a proxy, so links to resources should be https://
   property https_only : Bool?
   # HMAC signing key for CSRF tokens and verifying pubsub subscriptions
-  property hmac_key : String?
+  property hmac_key : String = ""
   # Domain to be used for links to resources on the site where an absolute URL is required
   property domain : String?
   # Subscribe to channels using PubSubHubbub (requires domain, hmac_key)
@@ -204,6 +204,16 @@ class Config
         end
     {% end %}
 
+    # HMAC_key is mandatory
+    # See: https://github.com/iv-org/invidious/issues/3854
+    if config.hmac_key.empty?
+      puts "Config: 'hmac_key' is required/can't be empty"
+      exit(1)
+    elsif config.hmac_key == "CHANGE_ME!!"
+      puts "Config: The value of 'hmac_key' needs to be changed!!"
+      exit(1)
+    end
+
     # Build database_url from db.* if it's not set directly
     if config.database_url.to_s.empty?
       if db = config.db
@@ -216,7 +226,7 @@ class Config
           path: db.dbname,
         )
       else
-        puts "Config : Either database_url or db.* is required"
+        puts "Config: Either database_url or db.* is required"
         exit(1)
       end
     end