MEDIUM: JWT_SECRET has a hardcoded default fallback in source code #8

New issue

Closed

opened 2026-05-09 00:02:34 +00:00 by Mark · 0 comments

Mark commented

2026-05-09 00:02:34 +00:00

Owner

Severity: Medium

Location

backend/src/auth.ts line 6

Description

The JWT secret has a weak hardcoded fallback when the JWT_SECRET environment variable is not set:

const JWT_SECRET = process.env.JWT_SECRET || 'your-secret-key-change-in-production';

Additionally, the current backend/.env file has: JWT_SECRET=subvault-secret-key-change-in-production — which still contains the placeholder message and was never changed.

Impact

Anyone who reads the source code knows the fallback secret
If the env var is missing in any deployment, the server silently uses the weak default secret
With the known secret, an attacker could forge arbitrary JWT tokens (once auth is re-enabled)

Suggested Fix

Remove the hardcoded fallback and crash at startup if the env var is missing:

const JWT_SECRET = process.env.JWT_SECRET;
if (!JWT_SECRET) {
  throw new Error('JWT_SECRET environment variable is required');
}

Generate a real strong secret (e.g., openssl rand -hex 64)

## Severity: Medium ## Location `backend/src/auth.ts` line 6 ## Description The JWT secret has a weak hardcoded fallback when the `JWT_SECRET` environment variable is not set: ```typescript const JWT_SECRET = process.env.JWT_SECRET || 'your-secret-key-change-in-production'; ``` Additionally, the current `backend/.env` file has: `JWT_SECRET=subvault-secret-key-change-in-production` — which still contains the placeholder message and was never changed. ## Impact - Anyone who reads the source code knows the fallback secret - If the env var is missing in any deployment, the server silently uses the weak default secret - With the known secret, an attacker could forge arbitrary JWT tokens (once auth is re-enabled) ## Suggested Fix 1. Remove the hardcoded fallback and crash at startup if the env var is missing: ```typescript const JWT_SECRET = process.env.JWT_SECRET; if (!JWT_SECRET) { throw new Error('JWT_SECRET environment variable is required'); } ``` 2. Generate a real strong secret (e.g., `openssl rand -hex 64`)