fix(auth): reject empty HMAC keys so authsign cannot fail open

New() accepted an empty hex-decoded key (literal "", unset env:, or
whitespace-only file:). HMAC-SHA256 with a zero-length key still
produces a verifiable token, so a misconfigured remote auth provider
would treat unauthenticated authsign requests as valid.

Reject empty keys after env/file resolution and after hex decode.

Signed-off-by: Sasha Mitchell <sash.t.mitchell@gmail.com>

Author: SashaMIT

auth/auth.go

@@ -50,21 +50,36 @@ func New(key string, ad []byte) (*Standard, error) {
 		switch splitKey[0] {
 		case "env":
 			key = os.Getenv(splitKey[1])
+			if key == "" {
+				return nil, fmt.Errorf("auth key environment variable %q is unset or empty", splitKey[1])
+			}
 		case "file":
 			data, err := os.ReadFile(splitKey[1])
 			if err != nil {
 				return nil, err
 			}
 			key = strings.TrimSpace(string(data))
+			if key == "" {
+				return nil, fmt.Errorf("auth key file %q is empty", splitKey[1])
+			}
 		default:
 			return nil, fmt.Errorf("unknown key prefix: %s", splitKey[0])
 		}
 	}
 
+	if key == "" {
+		return nil, fmt.Errorf("auth key must not be empty")
+	}
+
 	keyBytes, err := hex.DecodeString(key)
 	if err != nil {
 		return nil, err
 	}
+	if len(keyBytes) == 0 {
+		// hex.DecodeString("") succeeds with a zero-length key; reject so HMAC
+		// auth cannot fail open when a secret is missing/misconfigured.
+		return nil, fmt.Errorf("auth key must not be empty")
+	}
 
 	return &Standard{keyBytes, ad}, nil
 }

auth/auth_test.go

@@ -19,6 +19,23 @@ func TestNew(t *testing.T) {
 		t.Fatal("expected failure with improperly-hex-encoded key")
 	}
 
+	if _, err := New("", nil); err == nil {
+		t.Fatal("expected failure with empty key")
+	}
+
+	t.Setenv("CFSSL_AUTH_EMPTY", "")
+	if _, err := New("env:CFSSL_AUTH_EMPTY", nil); err == nil {
+		t.Fatal("expected failure with empty env key")
+	}
+
+	emptyFile := t.TempDir() + "/empty.key"
+	if err := os.WriteFile(emptyFile, []byte("   \n"), 0o600); err != nil {
+		t.Fatalf("%v", err)
+	}
+	if _, err := New("file:"+emptyFile, nil); err == nil {
+		t.Fatal("expected failure with empty file key")
+	}
+
 	testProvider, err = New(testKey, nil)
 	if err != nil {
 		t.Fatalf("%v", err)