@@ -28,43 +28,88 @@ public class DefaultCredentialChecker {
2828
2929 private static final Logger LOG = LoggerFactory .getLogger (DefaultCredentialChecker .class );
3030
31+ private static final String DEFAULT_AES_KEY_ERROR_MESSAGE =
32+ "The default AES key property is being used. "
33+ + "This must be changed to avoid a security breach!" ;
34+
35+ private static final String DEFAULT_AES_KEY = "1abcdefghilmnopqrstuvz2!" ;
36+
37+ private static final String DEFAULT_JWS_KEY_ERROR_MESSAGE =
38+ "The default JWKS key property is being used. "
39+ + "This must be changed to avoid a security breach!" ;
40+
3141 private static final String DEFAULT_JWS_KEY = "ZW7pRixehFuNUtnY5Se47IemgMryTzazPPJ9CGX5LTCmsOJpOgHAQEuPQeV9A28f" ;
3242
43+ private static final String DEFAULT_ADMIN_PASSWORD_ERROR_MESSAGE =
44+ "The default adminPassword property is being used. "
45+ + "This must be changed to avoid a security breach!" ;
46+
3347 private static final String DEFAULT_ADMIN_PASSWORD =
34- "DE088591C00CC98B36F5ADAAF7DA2B004CF7F2FE7BBB45B766B6409876E2F3DB13C7905C6AA59464" ;
48+ "DE088591C00CC98B36F5ADAAF7DA2B004CF7F2FE7BBB45B766B6409876E2F3DB13C7905C6AA59464" ;
49+
50+ private static final String DEFAULT_ANON_KEY_ERROR_MESSAGE =
51+ "The default anonymousKey property is being used. "
52+ + "This must be changed to avoid a security breach!" ;
3553
3654 private static final String DEFAULT_ANON_KEY = "anonymousKey" ;
3755
38- private final boolean defaultAdminPasswordInUse ;
56+ private final boolean defaultAesKeyInUse ;
3957
4058 private final boolean defaultJwsKeyInUse ;
4159
60+ private final boolean defaultAdminPasswordInUse ;
61+
4262 private final boolean defaultAnonymousKeyInUse ;
4363
44- public DefaultCredentialChecker (final String jwsKey , final String adminPassword , final String anonymousKey ) {
64+ private final boolean productionMode ;
65+
66+ public DefaultCredentialChecker (
67+ final String aesKey ,
68+ final String jwsKey ,
69+ final String adminPassword ,
70+ final String anonymousKey ,
71+ final boolean productionMode ) {
72+
73+ defaultAesKeyInUse = DEFAULT_AES_KEY .equals (aesKey );
4574 defaultJwsKeyInUse = DEFAULT_JWS_KEY .equals (jwsKey );
4675 defaultAdminPasswordInUse = DEFAULT_ADMIN_PASSWORD .equals (adminPassword );
4776 defaultAnonymousKeyInUse = DEFAULT_ANON_KEY .equals (anonymousKey );
77+ this .productionMode = productionMode ;
78+ }
79+
80+ public void checkIsDefaultAESKeyInUse () {
81+ if (defaultAesKeyInUse ) {
82+ if (productionMode ) {
83+ throw new IllegalStateException (DEFAULT_AES_KEY_ERROR_MESSAGE );
84+ }
85+ LOG .warn (DEFAULT_AES_KEY_ERROR_MESSAGE );
86+ }
4887 }
4988
5089 public void checkIsDefaultJWSKeyInUse () {
5190 if (defaultJwsKeyInUse ) {
52- LOG .warn ("The default jwsKey property is being used. "
53- + "This must be changed to avoid a security breach!" );
91+ if (productionMode ) {
92+ throw new IllegalStateException (DEFAULT_JWS_KEY_ERROR_MESSAGE );
93+ }
94+ LOG .warn (DEFAULT_JWS_KEY_ERROR_MESSAGE );
5495 }
5596 }
5697
5798 public void checkIsDefaultAdminPasswordInUse () {
5899 if (defaultAdminPasswordInUse ) {
59- LOG .warn ("The default adminPassword property is being used. "
60- + "This must be changed to avoid a security breach!" );
100+ if (productionMode ) {
101+ throw new IllegalStateException (DEFAULT_ADMIN_PASSWORD_ERROR_MESSAGE );
102+ }
103+ LOG .warn (DEFAULT_ADMIN_PASSWORD_ERROR_MESSAGE );
61104 }
62105 }
63106
64107 public void checkIsDefaultAnonymousKeyInUse () {
65108 if (defaultAnonymousKeyInUse ) {
66- LOG .warn ("The default anonymousKey property is being used. "
67- + "This must be changed to avoid a security breach!" );
109+ if (productionMode ) {
110+ throw new IllegalStateException (DEFAULT_ANON_KEY_ERROR_MESSAGE );
111+ }
112+ LOG .warn (DEFAULT_ANON_KEY_ERROR_MESSAGE );
68113 }
69114 }
70115}
0 commit comments