secret-strip george-gmail: env-first the hardcoded George basic-auth cred (server) + remove browser-embedded copy (client)

8c22e56db199b6ecface3159659be2b16b729975 · 2026-06-12 13:01:46 -0700 · Steve Abrams
Files touched

M public/index.html
M server.js
Diff

commit 8c22e56db199b6ecface3159659be2b16b729975
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Fri Jun 12 13:01:46 2026 -0700

    secret-strip george-gmail: env-first the hardcoded George basic-auth cred (server) + remove browser-embedded copy (client)
---
 public/index.html | 4 ++--
 server.js         | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/public/index.html b/public/index.html
index 1342ab9..cd269d1 100644
--- a/public/index.html
+++ b/public/index.html
@@ -56,13 +56,13 @@ body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;backgrou
 <body>
 <div id="root"></div>
 <script src="https://unpkg.com/react@18/umd/react.production.min.js"></script>
-function xfetch(url,opts){return new Promise(function(resolve,reject){var x=new XMLHttpRequest();x.open((opts&&opts.method)||"GET",url,true);x.setRequestHeader("Authorization","Basic "+btoa("admin:I3YusisdESUNdxtrmlb3QJeu9q8ODKJO"));if(opts&&opts.body){x.setRequestHeader("Content-Type","application/json");}x.onload=function(){try{resolve({ok:x.status>=200&&x.status<300,status:x.status,json:function(){return Promise.resolve(JSON.parse(x.responseText))},text:function(){return Promise.resolve(x.responseText)}})}catch(e){reject(e)}};x.onerror=function(){reject(new Error("XHR failed"))};x.send(opts&&opts.body?JSON.stringify(opts.body):null)})};
+function xfetch(url,opts){return new Promise(function(resolve,reject){var x=new XMLHttpRequest();x.open((opts&&opts.method)||"GET",url,true);x.withCredentials=true;if(opts&&opts.body){x.setRequestHeader("Content-Type","application/json");}x.onload=function(){try{resolve({ok:x.status>=200&&x.status<300,status:x.status,json:function(){return Promise.resolve(JSON.parse(x.responseText))},text:function(){return Promise.resolve(x.responseText)}})}catch(e){reject(e)}};x.onerror=function(){reject(new Error("XHR failed"))};x.send(opts&&opts.body?JSON.stringify(opts.body):null)})};
 <script src="https://unpkg.com/react-dom@18/umd/react-dom.production.min.js"></script>
 <script src="https://unpkg.com/@babel/standalone/babel.min.js"></script>
 <script type="text/babel">
 const { useState, useEffect, useCallback } = React;
 
-const AUTH = 'Basic ' + btoa('admin:I3YusisdESUNdxtrmlb3QJeu9q8ODKJO');
+const AUTH = '';
 async function api(path) {
   const r = await xfetch(path, { headers: { Authorization: AUTH } });
   return r.json();
diff --git a/server.js b/server.js
index e25a0e3..51515ab 100644
--- a/server.js
+++ b/server.js
@@ -1,7 +1,7 @@
 /**
  * George the Gmail Agent — Port 9889
  * Secure email access for DW-Agents ecosystem
- * Auth: admin / I3YusisdESUNdxtrmlb3QJeu9q8ODKJO
+ * Auth: admin / (set via GEORGE_BASIC_AUTH_PASS env var)
  */
 const express = require('express');
 const helmet = require('helmet');
@@ -233,7 +233,7 @@ const _GEORGE_AUTH_ENV =
 const _GEORGE_AUTH_SOURCE = _GEORGE_AUTH_ENV ? "env" : "hardcoded-fallback";
 const [_GEORGE_USER, _GEORGE_PASS] = _GEORGE_AUTH_ENV.includes(":")
   ? _GEORGE_AUTH_ENV.split(":")
-  : ["admin", (process.env.GEORGE_BASIC_AUTH_PASS || "I3YusisdESUNdxtrmlb3QJeu9q8ODKJO")];
+  : ["admin", (process.env.GEORGE_BASIC_AUTH_PASS || "")];
 console.log(`[George] basic-auth source: ${_GEORGE_AUTH_SOURCE} (user=${_GEORGE_USER}, pass-len=${_GEORGE_PASS.length})`);
 const crypto = require("crypto");
 function _ctEq(a, b) {
@@ -750,7 +750,7 @@ app.use((req, res, next) => {
   const auth = req.headers.authorization;
   if (!auth || !auth.startsWith('Basic ')) return res.status(401).json({ error: 'Auth required' });
   const [user, pass] = Buffer.from(auth.split(' ')[1], 'base64').toString().split(':');
-  if (user !== 'admin' || pass !== (process.env.GEORGE_BASIC_AUTH_PASS || 'I3YusisdESUNdxtrmlb3QJeu9q8ODKJO')) return res.status(401).json({ error: 'Invalid credentials' });
+  if (user !== 'admin' || pass !== (process.env.GEORGE_BASIC_AUTH_PASS || '')) return res.status(401).json({ error: 'Invalid credentials' });
   next();
 });
← cf27272 Add scoped one-shot trash for benign cron-drift alert flood · back to George Gmail · Add launchd KeepAlive supervisor for george-gmail :9850 (dur 918647c →