Hardcoded JWT Signing Key (ARCH7137)

Key php.security.hardcoded-jwt-signing-key · Severity error · Category security · CWE CWE-321

Embedding a JWT/HMAC signing key as a literal in source compromises token integrity the moment the source leaks. Once the attacker learns the key, they can forge valid tokens.

Incorrect

<?php
$jwt = JWT::encode($payload, 'super-secret-key-123', 'HS256'); // key in code

Correct

<?php
$key = getenv('JWT_SIGNING_KEY'); // environment variable / secret store
$jwt = JWT::encode($payload, $key, 'HS256');

Fix

Read the signing key from an environment variable or a secret manager; never keep it in source code.