security: harden API key handling and add startup warnings

- Increase auto-generated API key entropy from 192-bit to 384-bit
- Use hmac.compare_digest() for constant-time key comparison (HTTP + WS)
- Refuse to start without OPEN_TERMINAL_API_KEY configured
- Add prominent CORS wildcard warning at startup
- Bump version to 0.11.30

Author: tjbck

CHANGELOG.md

@@ -4,6 +4,15 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [0.11.30] - 2026-03-25
+
+### Changed
+
+- 🔑 **Stronger auto-generated API keys** — increased from 192-bit (32 chars) to 384-bit (64 chars) entropy, making brute-force attacks computationally infeasible.
+- 🔒 **API key required to start** — the server now refuses to start without an API key configured. The CLI auto-generates one as before, but running via `uvicorn` directly without setting `OPEN_TERMINAL_API_KEY` is no longer allowed.
+- 🛡️ **Constant-time API key comparison** — both HTTP and WebSocket authentication now use `hmac.compare_digest()` instead of `!=`, preventing timing-based key extraction.
+- ⚠️ **CORS default warning** — a prominent yellow box is printed at startup when `--cors-allowed-origins` is left at the default `*`, warning operators to restrict it for production.
+
 ## [0.11.29] - 2026-03-24
 
 ### Fixed

open_terminal/cli.py

@@ -86,7 +86,7 @@ def run(
 
     generated = not api_key
     if not api_key:
-        api_key = secrets.token_urlsafe(24)
+        api_key = secrets.token_urlsafe(48)
 
     os.environ["OPEN_TERMINAL_API_KEY"] = api_key
     os.environ["OPEN_TERMINAL_CORS_ALLOWED_ORIGINS"] = cors_allowed_origins
@@ -118,6 +118,16 @@ def run(
         click.echo(click.style("  Use --host 127.0.0.1 to restrict to this machine.", dim=True))
         click.echo()
 
+    if cors_allowed_origins.strip() == "*":
+        click.echo(click.style("  ┌─────────────────────────────────────────────────────────────┐", fg="yellow"))
+        click.echo(click.style("  │  ⚠  CORS is set to '*' (allow all origins)                 │", fg="yellow"))
+        click.echo(click.style("  │                                                             │", fg="yellow"))
+        click.echo(click.style("  │  Any website can make requests to this server.              │", fg="yellow"))
+        click.echo(click.style("  │  For production, restrict with:                             │", fg="yellow"))
+        click.echo(click.style("  │    --cors-allowed-origins https://your-domain.com           │", fg="yellow"))
+        click.echo(click.style("  └─────────────────────────────────────────────────────────────┘", fg="yellow"))
+        click.echo()
+
     from open_terminal.env import UVICORN_LOOP
     uvicorn.run("open_terminal.main:app", host=host, port=port, loop=UVICORN_LOOP)
 

open_terminal/main.py

@@ -1,4 +1,5 @@
 import asyncio
+import hmac
 from importlib.metadata import version as _pkg_version
 import fnmatch
 import json
@@ -31,6 +32,14 @@
     from open_terminal.utils.user_isolation import check_environment, resolve_user
     check_environment()
 
+if not API_KEY:
+    raise SystemExit(
+        "\n\033[91m"
+        "  OPEN_TERMINAL_API_KEY is required.\n"
+        "  Set via environment variable or --api-key flag.\n"
+        "\033[0m"
+    )
+
 try:
     import fcntl
     import pty
@@ -94,7 +103,7 @@ async def verify_api_key(
 ):
     if not API_KEY:
         return
-    if not credentials or credentials.credentials != API_KEY:
+    if not credentials or not hmac.compare_digest(credentials.credentials, API_KEY):
         raise HTTPException(status_code=401, detail="Invalid API key")
 
 
@@ -1579,7 +1588,7 @@ async def ws_terminal(ws: WebSocket, session_id: str):
             try:
                 msg = await asyncio.wait_for(ws.receive_text(), timeout=10.0)
                 payload = json.loads(msg)
-                if payload.get("type") != "auth" or payload.get("token") != API_KEY:
+                if payload.get("type") != "auth" or not hmac.compare_digest(payload.get("token", ""), API_KEY):
                     await ws.close(code=4001, reason="Invalid API key")
                     return
             except (asyncio.TimeoutError, json.JSONDecodeError, Exception):

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "open-terminal"
-version = "0.11.29"
+version = "0.11.30"
 description = "A remote terminal API."
 readme = "README.md"
 authors = [