checkAppKey method

void checkAppKey()

stop at startup when APP_KEY is missing, not exactly 32 characters, or a public sample key. a short or public key is easy to guess, so anyone can sign tokens and cookies. AES needs a key of 16, 24 or 32 bytes, so a longer key breaks encrypted cookies. in development, local and test it only logs a warning.

Implementation

void checkAppKey() {
  String key = config.appKey.trim();
  String message;
  if (key.isEmpty) {
    message =
        'APP_KEY is not set. Run `dox key:generate` and put the key in .env';
  } else if (_publicKeys.contains(key)) {
    message = 'APP_KEY is a public sample key. Run `dox key:generate` for a new one';
  } else if (utf8.encode(key).length != 32) {
    message = 'APP_KEY must be exactly 32 characters. Run `dox key:generate`';
  } else {
    return;
  }
  String env = Env.get<String>('APP_ENV').toLowerCase();
  if (!<String>['development', 'local', 'test'].contains(env)) {
    throw StateError(message);
  }
  Logger.warn(message);
}