Security: Fix hardcoded credentials and sensitive data exposure

.devcontainer/.env

@@ -1,5 +1,5 @@
 
 POSTGRES_DB=ginadmin
 POSTGRES_USER=postgres
-POSTGRES_PASSWORD=123456
-DATABASE_URL=postgres://postgres:123456@db:5432/ginadmin
+POSTGRES_PASSWORD=change_me
+DATABASE_URL=postgres://postgres:change_me@db:5432/ginadmin

configs/dev/middleware.toml

@@ -28,7 +28,7 @@ MaxContentLen = 134217728 # 128MB
 Disable = false
 SkippedPathPrefixes = ["/api/v1/captcha/", "/api/v1/login"]
 SigningMethod = "HS512" # HS256/HS384/HS512
-SigningKey = "XnEsT0S@" # Secret key
+SigningKey = "" # CHANGE_ME: generate a secure random key # Secret key
 OldSigningKey = "" # Old secret key (For change secret key)
 Expired = 86400 # seconds
 

internal/config/config.go

@@ -23,7 +23,7 @@ type General struct {
 	PprofAddr          string
 	DisableSwagger     bool
 	DisablePrintConfig bool
-	DefaultLoginPwd    string `default:"6351623c8cef86fefabfa7da046fc619"` // MD5(abc-123)
+	DefaultLoginPwd    string `default:""` // change default password
 	WorkDir            string // From command arguments
 	MenuFile           string // From schema.Menus (JSON/YAML)
 	DenyOperateMenu    bool
@@ -98,8 +98,8 @@ type Util struct {
 	Prometheus struct {
 		Enable         bool
 		Port           int    `default:"9100"`
-		BasicUsername  string `default:"admin"`
-		BasicPassword  string `default:"admin"`
+		BasicUsername  string `default:""`
+		BasicPassword  string `default:""`
 		LogApis        []string
 		LogMethods     []string
 		DefaultCollect bool

internal/config/middleware.go

@@ -36,7 +36,7 @@ type Middleware struct {
 		Disable             bool
 		SkippedPathPrefixes []string
 		SigningMethod       string `default:"HS512"`    // HS256/HS384/HS512
-		SigningKey          string `default:"XnEsT0S@"` // secret key
+		SigningKey          string `default:""` // change to a secure random key
 		OldSigningKey       string // old secret key (for migration)
 		Expired             int    `default:"86400"` // seconds
 		Store               struct {

internal/mods/rbac/biz/login.biz.go

@@ -131,7 +131,7 @@ func (a *Login) genUserToken(ctx context.Context, userID string) (*schema.LoginT
 	if err != nil {
 		return nil, err
 	}
-	logging.Context(ctx).Info("Generate user token", zap.Any("token", string(tokenBuf)))
+	logging.Context(ctx).Info("Generate user token")
 
 	return &schema.LoginToken{
 		AccessToken: token.GetAccessToken(),

internal/wirex/injector.go

@@ -1,6 +1,7 @@
 package wirex
 
 import (
+	"fmt"
 	"context"
 	"time"
 
@@ -87,6 +88,9 @@ func InitCacher(ctx context.Context) (cachex.Cacher, func(), error) {
 }
 
 func InitAuth(ctx context.Context) (jwtx.Auther, func(), error) {
+	if config.C.Middleware.Auth.SigningKey == "" {
+		return nil, nil, fmt.Errorf("middleware.auth.signingKey is required, please set a secure random key")
+	}
 	cfg := config.C.Middleware.Auth
 	var opts []jwtx.Option
 	opts = append(opts, jwtx.SetExpired(cfg.Expired))

pkg/jwtx/jwt.go

@@ -19,7 +19,7 @@ type Auther interface {
 	Release(ctx context.Context) error
 }
 
-const defaultKey = "CG24SDVP8OHPK395GB5G"
+
 
 var ErrInvalidToken = errors.New("Invalid token")
 
@@ -60,7 +60,7 @@ func New(store Storer, opts ...Option) Auther {
 		tokenType:     "Bearer",
 		expired:       7200,
 		signingMethod: jwt.SigningMethodHS512,
-		signingKey:    []byte(defaultKey),
+		signingKey:    []byte{},
 	}
 
 	for _, opt := range opts {