Skip to content

fix: guard AUTH_BYPASS from taking effect in production#167

Open
jakebromberg wants to merge 2 commits intomainfrom
fix/2-auth-bypass-guard
Open

fix: guard AUTH_BYPASS from taking effect in production#167
jakebromberg wants to merge 2 commits intomainfrom
fix/2-auth-bypass-guard

Conversation

@jakebromberg
Copy link
Member

Summary

  • AUTH_BYPASS=true silently disables all authorization middleware with no environment guard
  • Added NODE_ENV !== 'production' check so the bypass only works in dev/test
  • Added unit tests verifying the guard works correctly in all combinations

Test plan

  • Unit test: AUTH_BYPASS=true + NODE_ENV=production → auth NOT bypassed (401)
  • Unit test: AUTH_BYPASS=true + NODE_ENV=test → auth bypassed
  • Unit test: AUTH_BYPASS=true + NODE_ENV unset → auth bypassed
  • Unit test: AUTH_BYPASS unset → auth NOT bypassed (401)

Made with Cursor

AUTH_BYPASS=true silently disables all authorization middleware.
Add a NODE_ENV !== 'production' guard so it only works in dev/test.

Co-authored-by: Cursor <cursoragent@cursor.com>
@jakebromberg jakebromberg force-pushed the fix/2-auth-bypass-guard branch from 113ff10 to ba9a98b Compare February 27, 2026 05:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant