Hardcoded JavaScript Web Token in source codeSCT-1004

Leaking a JavaScript Web Token (JWT) in the source code can pose a serious security risk, as it can give unauthorized access to resources and sensitive information in the web application. This can lead to data breaches and loss of confidential information.

If a JWT secret has been leaked, you can deprecate the old secret and use a new one to mitigate the vulnerability.

It is recommended to remove any hard-coded secrets from source code and instead use environment variables or a secure key management service (KMS) to store and manage secrets. Additionally, it is important to ensure that only authorized users have access to these secrets.

Bad practice

const jwt = require('jsonwebtoken');

const user = {
  id: 1,
  username: 'john.doe',
  role: 'admin'
};

const token = jwt.sign(user, 'SUPER_CONFIDENTIAL_SECRET');

Recommended

const jwt = require('jsonwebtoken');
const dotenv = require('dotenv');

dotenv.config(); // loads environment variables from a .env file

const user = {
  id: 1,
  username: 'john.doe',
  role: 'admin'
};

const token = jwt.sign(user, process.env.JWT_SECRET);