fix(auth): enforce required JWT key to prevent forged token attacks - #1223
Draft
nbmaiti wants to merge 3 commits into
Draft
fix(auth): enforce required JWT key to prevent forged token attacks#1223nbmaiti wants to merge 3 commits into
nbmaiti wants to merge 3 commits into
Conversation
Prevents vulnerability by rejecting hardcoded insecure JWT defaults. Changed from hardcoded default 'your_secret_jwt_key' to empty string and added config validation that fails fast at startup if AUTH_JWT_KEY is not provided. This ensures proper JWT configuration for both YAML and environment variable deployments. Signed-off-by: Nabendu Maiti <[email protected]>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens authentication configuration by removing an insecure default JWT signing key and introducing startup-time validation to prevent running with an unset JWT key.
Changes:
- Removed the hardcoded default
auth.jwtKeyvalue (your_secret_jwt_key) from the in-memory default config. - Added config validation to fail fast when
auth.jwtKeyis empty. - Introduced a dedicated config error (
ErrJWTKeyMissing) for missing JWT key configuration.
Suppressed comments (2)
config/config.go:423
- Current jwtKey validation only rejects an empty string. Existing deployments (and the repo's config/config.yml) may still use the placeholder value "your_secret_jwt_key", which would pass validation and keeps the forged-token risk this PR intends to prevent. Consider explicitly rejecting that placeholder value as well.
if c.JWTKey == "" {
return ErrJWTKeyMissing
}
config/config.go:423
- New startup validation for auth.jwtKey should be covered by unit tests (e.g., NewConfig/validate returns ErrJWTKeyMissing when jwtKey is empty or set to the placeholder). This helps prevent regressions in config loading precedence (defaults vs YAML vs env).
if c.JWTKey == "" {
return ErrJWTKeyMissing
}
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
…uirements Tests now set AUTH_JWT_KEY environment variable to satisfy the newly added config validation that requires a non-empty JWT key at startup. Signed-off-by: Nabendu Maiti <[email protected]>
The TestValidate_ValidDefaults test needs to set a valid JWT key since validation now requires a non-empty key. Signed-off-by: Nabendu Maiti <[email protected]>
nbmaiti
force-pushed
the
pr/jwt_no_default_jwt_key
branch
from
August 26, 2026 15:22
4dd0d9d to
1168c14
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prevents vulnerability by rejecting hardcoded insecure JWT defaults. Changed from hardcoded default 'your_secret_jwt_key' to empty string and added config validation that fails fast at startup if AUTH_JWT_KEY is not provided. This ensures proper JWT configuration for both YAML and environment variable deployments.