From 341967ac56ef8169de5139565ca0235d72ec7f11 Mon Sep 17 00:00:00 2001 From: Lakhan Samani Date: Fri, 14 Aug 2026 10:43:00 +0530 Subject: [PATCH] fix: AUTHORIZER_URL is required in 2.4.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #764 made --url mandatory in Authorizer 2.4.0 — the server exits at boot without it. This deploy path passed the flag but treated the value as optional, so a default deploy produces a server that will not start. The blueprint comment described it as optional. Left as sync:false — Render prompts at deploy and a blueprint cannot concatenate the scheme onto fromService.host, so it cannot be populated automatically. --- README.md | 1 + render.yaml | 18 +++++++++++++----- 2 files changed, 14 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index a06c015..ea77156 100644 --- a/README.md +++ b/README.md @@ -20,6 +20,7 @@ Authorizer v2 requires the following variables. Configure them in Render's envir | -------- | ----------- | ------- | | `DATABASE_TYPE` | Database type | `postgres` | | `DATABASE_URL` | Database connection string | *(auto-configured by Render)* | +| `AUTHORIZER_URL` | This deployment's own public base URL **(required)**. Not the same as allowed origins — this is where Authorizer itself lives. The server exits at boot without it | `https://your-app.onrender.com` | | `JWT_TYPE` | JWT signing algorithm | `HS256` | | `JWT_SECRET` | JWT signing secret | `test` | | `ENCRYPTION_KEY` | At-rest key for TOTP secrets and OTP digests. Required with `RS*`/`ES*` | *(output of `openssl rand -hex 32`)* | diff --git a/render.yaml b/render.yaml index 870f347..c9e9d98 100644 --- a/render.yaml +++ b/render.yaml @@ -39,12 +39,20 @@ services: # it is a new internet-facing authenticated surface. value: "false" - key: AUTHORIZER_URL - # Canonical/trusted base URL of this deployment (e.g. your Render - # service URL). When set, it is the only source used to build + # REQUIRED — the server exits at boot without it, so the service will + # fail to start until this is set. Render prompts for it at blueprint + # deploy; if you skip the prompt, set it in the dashboard as soon as + # the service URL is known and redeploy. + # + # Canonical/trusted base URL of this deployment — your Render service + # URL, e.g. https://authorizer.onrender.com (include the scheme; a + # bare hostname is rejected). It is the only source used to build # verification/reset/magic-link URLs, the JWT iss claim, and OIDC - # discovery URLs. Leaving it empty exposes host-header-injection - # account takeover (CWE-640) — set this in the Render dashboard - # once the service URL is known. + # discovery URLs; deriving them from request headers instead exposes + # host-header-injection account takeover (CWE-640). + # + # Not populated automatically: a blueprint cannot concatenate the + # scheme onto fromService.host, and the value must be a full URL. sync: false # ---------------------------------------------------------------- # April 2026 security hardening flags. See