{"record":{"id":"6c0650e47c722999","repo":"iflytek/astron-agent","slug":"workflow-internal-api-key-must-contain-a-non-default-value","errorCode":null,"errorMessage":"WORKFLOW_INTERNAL_API_KEY must contain a non-default value of at least 32 characters","messagePattern":"WORKFLOW_INTERNAL_API_KEY must contain a non-default value of at least 32 characters","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"critical","filePath":"console/backend/commons/src/main/java/com/iflytek/astron/console/commons/security/WorkflowInternalApiKey.java","lineNumber":22,"sourceCode":"\n/** Shared validation and header naming for trusted calls to the core workflow service. */\npublic final class WorkflowInternalApiKey {\n\n    public static final String HEADER = \"X-Workflow-Internal-Key\";\n\n    private static final String PLACEHOLDER = \"CHANGE_ME_WORKFLOW_INTERNAL_API_KEY\";\n    private static final int MIN_LENGTH = 32;\n\n    private WorkflowInternalApiKey() {}\n\n    /** Return a normalized credential or fail closed before issuing an internal request. */\n    public static String requireConfigured(String configuredValue) {\n        String apiKey = StringUtils.trimToEmpty(configuredValue);\n        if (apiKey.length() < MIN_LENGTH\n                || PLACEHOLDER.equals(apiKey)\n                || apiKey.indexOf('\\r') >= 0\n                || apiKey.indexOf('\\n') >= 0) {\n            throw new IllegalStateException(\n                    \"WORKFLOW_INTERNAL_API_KEY must contain a non-default value of at least 32 characters\");\n        }\n        return apiKey;\n    }\n}\n","sourceCodeStart":4,"sourceCodeEnd":28,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/console/backend/commons/src/main/java/com/iflytek/astron/console/commons/security/WorkflowInternalApiKey.java#L4-L28","documentation":"WorkflowInternalApiKey.requireConfigured enforces that WORKFLOW_INTERNAL_API_KEY is a non-default value of at least MIN_LENGTH (32) characters, trimmed, without CR/LF. If the configured value is missing/too short/still the placeholder, it throws IllegalStateException at startup or first use, refusing insecure internal signing.","triggerScenarios":"Env var WORKFLOW_INTERNAL_API_KEY unset or empty; left at the documented placeholder/default value; a short dev key (<32 chars) promoted to prod; a key accidentally containing newlines (e.g. multiline YAML secret).","commonSituations":"Deploying docker-compose/Helm without setting the secret; copying example config verbatim; Kubernetes secret with trailing newline embedded in value; local dev runs with sample .env.","solutions":["Set WORKFLOW_INTERNAL_API_KEY to a cryptographically random value of at least 32 characters (e.g. openssl rand -hex 32)","Remove the placeholder/default value — generate a fresh secret per environment","Check the secret source for stray newlines (Kubernetes secret data, YAML folding)","Restart the service after updating the env so requireConfigured passes"],"exampleFix":"// before\n# .env\nWORKFLOW_INTERNAL_API_KEY=change-me\n// after\n# generate: openssl rand -hex 32\nWORKFLOW_INTERNAL_API_KEY=9f2c4e...64-hex-chars...ab","handlingStrategy":"validation","validationCode":"String k = System.getenv(\"WORKFLOW_INTERNAL_API_KEY\"); boolean ok = k != null && k.trim().length() >= 32 && !\"change-me\".equals(k.trim()) && !k.contains(\"\\n\") && !k.contains(\"\\r\");","typeGuard":null,"tryCatchPattern":"try { WorkflowInternalApiKey.requireConfigured(configuredValue); } catch (IllegalStateException e) { throw new IllegalStateException(\"Fix WORKFLOW_INTERNAL_API_KEY in the environment\", e); }","preventionTips":["Generate a unique 32+ char random key per environment (openssl rand -hex 32)","Never commit placeholder values in deploy configs; use secret managers","Ensure secret delivery preserves the value verbatim (no added newlines)","Fail fast at startup and alert rather than serving with a default key"],"tags":["config","secret","startup"],"backgroundTag":"missing-env-var","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}