Added a auth.session.secret config value for setting the express session secret

plugins/auth-backend/package.json

@@ -71,5 +71,26 @@
   "files": [
     "dist",
     "migrations"
-  ]
+  ],
+  "configSchema": {
+    "$schema": "https://backstage.io/schema/config-v1",
+    "title": "@backstage/auth-backend",
+    "type": "object",
+    "properties": {
+      "auth": {
+        "type": "object",
+        "properties": {
+          "session": {
+            "type": "object",
+            "properties": {
+              "secret": {
+                "type": "string",
+                "visibility": "secret"
+              }
+            }
+          }
+        }
+      }
+    }
+  }
 }

plugins/auth-backend/src/service/router.ts

@@ -60,7 +60,9 @@ export async function createRouter({
   });
   const catalogApi = new CatalogClient({ discoveryApi: discovery });
 
-  const secret = 'backstage secret'; // TODO: Allow an override here
+  const secret =
+    config.getOptionalString('auth.session.secret') ?? 'backstage secret';
+  console.log('using secret', secret);
   router.use(cookieParser(secret));
   router.use(session({ secret, saveUninitialized: false, resave: false }));
   router.use(express.urlencoded({ extended: false }));