Hardcoded JWT Signing Key (ARCH8137)
Ce contenu n’est pas encore disponible dans votre langue.
Key kotlin.security.hardcoded-jwt-signing-key · Severity error · Category security · CWE CWE-321
Flags JWT signing keys passed as string literals (Keys.hmacShaKeyFor("..."), Algorithm.HMAC256("...")).
Incorrect
Section titled “Incorrect”val algorithm = Algorithm.HMAC256("change-me-secret")Correct
Section titled “Correct”val algorithm = Algorithm.HMAC256(System.getenv("JWT_SECRET"))Load the signing key from configuration; rotate it if it was ever committed.