Hardcoded JWT Signing Key (ARCH4137)

Key java.security.hardcoded-jwt-signing-key · Severity error · Category security · CWE CWE-321

Embedding a JWT signing key as a literal in source compromises token integrity the moment the source leaks; an attacker can forge valid tokens. Load the key from the environment or a secret manager.

Incorrect

String secret = "supersecretkey123"; // embedded in source
String jwt = Jwts.builder().setSubject(user)
    .signWith(Keys.hmacShaKeyFor(secret.getBytes())).compact();

Correct

byte[] secret = Base64.getDecoder().decode(System.getenv("JWT_SIGNING_KEY"));
String jwt = Jwts.builder().setSubject(user)
    .signWith(Keys.hmacShaKeyFor(secret)).compact();

Fix

Load the signing key from an environment variable or secret manager; never embed it in source.