fix: warn when secure signing is disabled

Author: harlan-zw

CHANGELOG.md

@@ -1,6 +1,22 @@
 # Changelog
 
 
+## v6.7.3...main
+
+[compare changes](https://github.com/nuxt-modules/og-image/compare/v6.7.3...main)
+
+### 🩹 Fixes
+
+- Parse queries from event paths ([#642](https://github.com/nuxt-modules/og-image/pull/642))
+
+### 🏡 Chore
+
+- Bump deps ([5bd2bdb3](https://github.com/nuxt-modules/og-image/commit/5bd2bdb3))
+
+### ❤️ Contributors
+
+- Harlan Wilton ([@harlan-zw](https://github.com/harlan-zw))
+
 ## v6.7.2...main
 
 [compare changes](https://github.com/nuxt-modules/og-image/compare/v6.7.2...main)

docs/content/3.guides/18.security.md

@@ -73,6 +73,12 @@ export default defineNuxtConfig({
 })
 ```
 
+::warning
+With signing disabled, an attacker can do more than trigger arbitrary renders: by supplying a `cacheKey` in the request they can **poison the runtime cache**, overwriting the cached image that your legitimate OG image URLs serve and spoofing the preview shown on social platforms. Only disable signing if the `/_og/` endpoint is otherwise protected (a WAF, origin restriction) or your images are fully prerendered.
+
+URL signing will be **required in v7** whenever runtime image generation is enabled.
+::
+
 ### Setup (stable secret)
 
 1. Generate a secret:

src/module.ts

@@ -449,7 +449,13 @@ export default defineNuxtModule<ModuleOptions>({
       if (!nuxt.options.dev || config.zeroRuntime || !hasServerRuntime)
         return
       if (signing.optOut) {
-        logger.warn('OG image URL signing is disabled (`security.secret: false`). Anyone can craft arbitrary image generation requests.')
+        logger.warn([
+          'OG image URL signing is disabled (`security.secret: false`).',
+          'Attackers can craft image requests and poison the cache so your real OG image URLs serve attacker-controlled content (content spoofing).',
+          'Signing will be required in v7 whenever runtime image generation is enabled. Leave signing on, or set an explicit secret:',
+          '  NUXT_OG_IMAGE_SECRET=<secret>',
+          '  Generate one with: npx nuxt-og-image generate-secret',
+        ].join('\n'))
       }
       else if (signing.generated) {
         logger.warn([