fix(security): remove insecure default secret from GOOSE_EXTERNAL_BACKEND (#7783)

Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
2026-03-10 16:27:37 +01:00
parent a191f0d958
commit b6d6984125
4 changed files with 30 additions and 5 deletions
@@ -511,7 +511,13 @@ const getServerSecret = (settings: Settings): string => {
    return settings.externalGoosed.secret;
  }
  if (process.env.GOOSE_EXTERNAL_BACKEND) {
-    return 'test';
+    if (!process.env.GOOSE_SERVER__SECRET_KEY) {
+      throw new Error(
+        'GOOSE_SERVER__SECRET_KEY must be set when using GOOSE_EXTERNAL_BACKEND. ' +
+          'Set it to the same value on both the server and the desktop client.'
+      );
+    }
+    return process.env.GOOSE_SERVER__SECRET_KEY;
  }
  return GENERATED_SECRET;
 };