Merge pull request #18088 from overleaf/ab-session-secret-rotation

[web/realtime/history-v1] Support session secret rotation

GitOrigin-RevId: 3c2fa27b1b3e0a8e0c9d1af2e616ce873d54aedf

services/real-time/app.js

@@ -56,7 +56,17 @@ const io = require('socket.io').listen(server, {
 
 // Bind to sessions
 const sessionStore = new RedisStore({ client: sessionRedisClient })
-const cookieParser = CookieParser(Settings.security.sessionSecret)
+
+if (!Settings.security.sessionSecret) {
+  throw new Error('No SESSION_SECRET provided.')
+}
+
+const sessionSecrets = [
+  Settings.security.sessionSecret,
+  Settings.security.sessionSecretUpcoming,
+  Settings.security.sessionSecretFallback,
+].filter(Boolean)
+const cookieParser = CookieParser(sessionSecrets)
 
 const sessionSockets = new SessionSockets(
   io,

services/real-time/config/settings.defaults.js

@@ -105,7 +105,9 @@ const settings = {
   },
 
   security: {
-    sessionSecret: process.env.SESSION_SECRET || 'secret-please-change',
+    sessionSecret: process.env.SESSION_SECRET,
+    sessionSecretUpcoming: process.env.SESSION_SECRET_UPCOMING,
+    sessionSecretFallback: process.env.SESSION_SECRET_FALLBACK,
   },
 
   cookieName: process.env.COOKIE_NAME || 'overleaf.sid',

services/real-time/config/settings.test.js

@@ -2,4 +2,9 @@ module.exports = {
   errors: {
     catchUncaughtErrors: false,
   },
+
+  security: {
+    sessionSecret: 'static-secret-for-tests',
+    sessionSecretFallback: 'static-secret-fallback-for-tests',
+  },
 }

services/real-time/package.json

@@ -27,7 +27,7 @@
     "body-parser": "^1.19.0",
     "bunyan": "^1.8.15",
     "connect-redis": "^6.1.3",
-    "cookie-parser": "^1.4.5",
+    "cookie-parser": "^1.4.6",
     "express": "^4.19.2",
     "express-session": "^1.17.1",
     "joi": "^17.12.0",