Hardcoded JWT Signing Key (ARCH8137)
Dieser Inhalt ist noch nicht in deiner Sprache verfügbar.
Key kotlin.security.hardcoded-jwt-signing-key · Severity error · Category security · CWE CWE-321
Flags JWT signing keys passed as string literals (Keys.hmacShaKeyFor("..."), Algorithm.HMAC256("...")).
Incorrect
Section titled “Incorrect”val algorithm = Algorithm.HMAC256("change-me-secret")Correct
Section titled “Correct”val algorithm = Algorithm.HMAC256(System.getenv("JWT_SECRET"))Load the signing key from configuration; rotate it if it was ever committed.