security: issue a warning on boot when secrets are default

checkup/checkup.go

@@ -4,10 +4,17 @@ import (
 	"runtime"
 	"syscall"
 
+	"github.com/TykTechnologies/tyk/config"
 	logger "github.com/TykTechnologies/tyk/log"
 )
 
-var log = logger.Get()
+var (
+	log            = logger.Get()
+	defaultConfigs = config.Config{
+		Secret:     "352d20ee67be67f6340b4c0605b044b7",
+		NodeSecret: "352d20ee67be67f6340b4c0605b044b7",
+	}
+)
 
 const (
 	minCPU             = 2
@@ -34,3 +41,14 @@ func CheckCpus() {
 			"\tPlease refer to https://tyk.io/docs/deploy-tyk-premise-production/#use-the-right-hardware for further guidance.", cpus, minCPU)
 	}
 }
+
+func CheckDefaultSecrets(c config.Config) {
+
+	if c.Secret == defaultConfigs.Secret {
+		log.Warningf("Default secret `%s` should be changed for production.", defaultConfigs.Secret)
+	}
+
+	if c.NodeSecret == defaultConfigs.NodeSecret {
+		log.Warningf("Default node_secret `%s` should be changed for production.", defaultConfigs.NodeSecret)
+	}
+}

main.go

@@ -931,6 +931,7 @@ func main() {
 
 	checkup.CheckFileDescriptors()
 	checkup.CheckCpus()
+	checkup.CheckDefaultSecrets(config.Global())
 
 	// Wait while Redis connection pools are ready before start serving traffic
 	if !storage.IsConnected() {