Merge pull request #253 from KotapatiSaiMounika/fix-session-secret

Fix hardcoded Express session secret

Author: KotapatiSaiMounika

backend/.env.example

@@ -15,4 +15,6 @@ CLOUDINARY_API_SECRET=your_api_secret
 EMAIL_USER=youremail@gmail.com
 EMAIL_PASS=yourapppassword 
 
-NODE_ENV=development  # "development" for local or "production" for deployment
+NODE_ENV=development  # "development" for local or "production" for deployment
+
+SESSION_SECRET=replace_with_secure_random_secret

backend/index.js

@@ -36,9 +36,13 @@ connectDB();
 
 app.use(bodyParser.json());
 
+if (!process.env.SESSION_SECRET) {
+  throw new Error("SESSION_SECRET environment variable is required");
+}
+
 app.use(
   session({
-    secret: "keyboard cat",
+    secret: process.env.SESSION_SECRET,
     resave: false,
     saveUninitialized: false,
     cookie: {